ClawHub

Shelter

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed read-only Shelter financial-data integration, but users should treat its API key and returned financial insights as sensitive.

Install only if you trust Shelter with the financial accounts connected through Plaid and are comfortable letting your agent request read-only financial insights from Shelter. Keep SHELTER_API_KEY private, do not commit or share it, revoke or rotate it if exposed, and prefer scoped keys and structured endpoints over free-form financial questions when possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README tells users to place a live financial-data API key directly into an exported environment variable but does not warn that the key is sensitive or advise safer handling practices. In shared terminals, shell history, screenshots, dotfiles, CI logs, or support copy/paste workflows, this can lead to credential disclosure and unauthorized read access to a user's banking-derived financial insights.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
This skill handles highly sensitive financial data, yet the introductory description does not include a clear user-facing warning that bank-derived data will be transmitted to a third-party API service. In a financial context, lack of explicit privacy disclosure increases the risk of users unknowingly authorizing access to sensitive balances, commitments, and spending insights.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal