ClawHub
Back to skill

Security audit

Guest Circuit

Security checks across malware telemetry and agentic risk

Overview

This skill performs disclosed public web research for podcast guest outreach and writes a local markdown report, with no hidden persistence or destructive behavior found.

Install if you want an agent to research public podcast appearances and recent public work for outreach. Be aware it will spend web-search/fetch calls, may use configured Podcast Index MCP tools, may run parallel research subagents, and will write a local markdown report unless you specify another path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The markdown instructs the skill to write output to `circuit/{name-slug}-{YYYY-MM-DD}.md` or another user-stated location, which is a filesystem write operation. While this is part of the skill workflow, the description does not clearly warn the user that invoking the skill will create a local file, only that it spends web-search calls.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.