ClawHub

Agos Marketplace

Security checks across malware telemetry and agentic risk

Overview

This skill is transparent about using AGOS Marketplace, but it can create live listings and purchase orders with limited built-in confirmation safeguards.

Install only if you want an agent to create real AGOS Marketplace records. Provide explicit listing IDs, wallet addresses, prices, and task payloads; avoid relying on first-listing auto-selection or default wallets; use dry-run for listings first; and review any payment_preparation output before performing any separate wallet or on-chain payment action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description is broad enough to trigger on generic marketplace, listing, order, payment-preparation, or workflow requests, which increases the chance of unintended invocation. In this skill's context, unintended invocation is more dangerous because the described behavior includes real external order/listing creation rather than harmless read-only assistance.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises automatic creation of marketplace listings and purchase orders but does not prominently require user confirmation or warn that these are irreversible external state-changing actions. That omission can lead users or upstream orchestrators to trigger live marketplace operations accidentally, potentially causing financial exposure or unwanted listings/orders.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal