ClawHub
Back to skill

Security audit

EngageLab Web Push

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed EngageLab Web Push API helper, but users should confirm targets carefully before sends, schedules, or deletion actions.

Install only if you want an agent to help manage EngageLab Web Push. Treat AppKey and Master Secret as sensitive, preview exact recipients and message bodies before sending, require explicit confirmation for broadcasts, schedule changes, and deletion by registration_id, and use callback signature verification for production callback endpoints.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documents an irreversible user-deletion API that removes a registration_id and associated data, but it does not require an explicit confirmation or safety warning in usage guidance. In an agent setting, that omission materially increases the risk of accidental destructive actions from ambiguous or mistaken user prompts.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation makes callback authentication optional even though the endpoint receives externally triggered POST requests containing delivery and click status data. If implementers follow the insecure path, attackers may spoof callbacks, inject fake analytics/events, or trigger downstream business logic that trusts callback contents, especially because the verification flow otherwise accepts any POST that reaches the endpoint.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.