ClawHub
Back to skill

Security audit

angel-diligence

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed angel-investing research assistant that writes a local evidence memo and avoids making investment recommendations.

Install only if you are comfortable with an agent using public web research and subagents to prepare investment diligence. Do not provide confidential deck details unless you trust the runtime to follow the skill's safeguards, and check the suggested local memo path before saving sensitive deal notes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Low
Confidence
93% confidence
Finding
The skill explicitly instructs the agent to write a memo to a local file path, but it does not require confirmation before creating or overwriting files, nor does it constrain behavior to a guaranteed-safe workspace. In an agentic environment with file-write capability, this can cause unintended local state changes, data loss from overwrites, or creation of sensitive diligence artifacts on disk without the user's clear consent.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.