ClawHub
Back to skill

Security audit

zoo-security-scanner

Security checks across malware telemetry and agentic risk

Overview

This is a coherent paid security-scanner skill, but it can send targets to a third party and trigger USDC payments without clear confirmation or authorization safeguards.

Install only if you are comfortable with an agent sending scan targets to ZOO Technologies and potentially making USDC payments. Before each use, confirm the target is yours or you have permission to test it, verify pricing, and require explicit approval before any scan or payment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill advertises that it can scan 'any URL, skill, or infrastructure' without defining authorization, ownership, scope limits, or prohibited targets. In an agent setting, this can encourage misuse for unauthorized reconnaissance or scanning of third-party systems, especially when combined with a simple one-call API workflow.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description omits a prominent warning that using the skill sends target data to an external service and may trigger automatic USDC payment via x402. Users or agents may invoke it without understanding the privacy, cost, and consent implications, which is particularly risky for sensitive internal URLs or autonomous agent workflows.

External Transmission

Medium
Category
Data Exfiltration
Content
### Scan a URL
```bash
curl -X POST https://api.zootechnologies.com/scan \
  -H "Content-Type: application/json" \
  -d '{"target": "https://example.com", "scan_type": "full"}'
```
Confidence
86% confidence
Finding
curl -X POST https://api.zootechnologies.com/scan \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
### Scan a URL
```bash
curl -X POST https://api.zootechnologies.com/scan \
  -H "Content-Type: application/json" \
  -d '{"target": "https://example.com", "scan_type": "full"}'
```
Confidence
86% confidence
Finding
https://api.zootechnologies.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.