ClawHub
Back to skill

Security audit

prompt-sanitizer

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward paid remote prompt-sanitizer, but anything you submit is sent to its third-party endpoint.

Install only if you trust the `awal` CLI and the listed API provider. Do not submit secrets, regulated personal data, or confidential prompts unless you are comfortable with that third party processing them, and review the authenticated payment flow because each request is documented as costing $0.005 USDC.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The description is broad enough to be invoked for many generic safety- or input-related requests, which can cause oversharing of user prompts to an external paid service without clear user intent. In agent ecosystems, overly broad routing increases the chance that sensitive or unrelated text is sent off-platform unexpectedly.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The usage example sends arbitrary prompt text, including PII, to a remote external service, but the markdown does not warn users that their content leaves the local environment. Because this skill is specifically designed to inspect prompts for PII and injection, it is especially likely to receive sensitive inputs, making the omission more dangerous.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal