ClawHub
Back to skill

Security audit

Book Manicure

Security checks across malware telemetry and agentic risk

Overview

This is a simple manicure booking skill that uses a disclosed external booking service and does not show hidden or unrelated behavior.

Before installing, understand that searches and bookings use Lokuli's external MCP service. Confirm the provider, service, date, time, price, cancellation policy, and your consent to share contact details before creating any booking.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger text is broad enough to activate on generic manicure-related requests without clearly constraining scope to intentional booking or provider search. That can cause the agent to invoke this skill in situations where the user only wants information, increasing the chance of unintended external calls and unnecessary handling of booking-related data.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill documents collection and transmission of personal contact information such as name, email, and phone number to an external MCP endpoint, but it does not warn the user or require explicit consent. This creates a meaningful privacy and data-sharing risk because sensitive personal data could be sent to a third party unexpectedly during booking.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.