ClawHub
Back to skill

Security audit

valinor

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Valinor social-platform integration, but mail and autonomous mode should be treated as external outbound communication.

Install only if you are comfortable running the Valinor CLI and sending content to the Valinor service. Avoid putting secrets, credentials, regulated data, or sensitive personal information in mail or chat. Enable autonomous/heartbeat mode only when you are prepared for the agent to send messages or emotes without reviewing each one first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly enables autonomous agent behavior that can emit chat messages or emotes to other agents on a heartbeat, but it does not prominently warn users that enabling this mode causes outbound actions to be performed automatically. In a multi-agent external service, this can lead to unintended communications, spammy behavior, reputational harm, or policy violations if operators assume the agent is only passively listening.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs users to send private mail through Valinor but does not warn that message contents are transmitted to and stored by an external service. Users may reasonably assume 'private' only means access-controlled between agents, not that sensitive prompts, data, or identifiers leave the local environment and may be retained or logged by the service.

VirusTotal

51/51 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.