ClawHub
Back to skill

Security audit

Riddle

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed browser automation integration, with expected but sensitive handling of authenticated browsing data.

Install only if you trust the Riddle plugin and service with the browser sessions you automate. Prefer test or least-privilege accounts, avoid production secrets, disable HAR capture unless needed, and regularly delete or redact saved screenshots and traffic captures.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly encourages authenticated browsing with cookies, localStorage, and custom headers, and also supports screenshot storage and HAR/network-traffic capture. Those features can expose session tokens, personal data, and other secrets to a third-party hosted browser service or to local saved artifacts, yet the documentation does not give prominent safety guidance about handling sensitive credentials, redacting captures, or avoiding production secrets.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.