ClawHub
Back to skill

Security audit

Book Nutritionist

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Lokuli booking helper that shares contact details only as part of creating a nutritionist appointment.

Install this only if you are comfortable using Lokuli as the external booking service. Before creating an appointment, review the provider and time slot and confirm that your name, email, and phone number will be sent to complete the booking.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger description is broad enough that the skill could be invoked for generic nutrition-related queries, not just clear booking intents. That can cause unnecessary routing to an external booking workflow and increase the chance that user context or subsequent personal data is collected or sent when the user only wanted informational help.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill includes a create_booking flow that transmits personal contact information such as name, email, and phone number to an external MCP endpoint, but the description provides no warning or consent boundary. This creates a privacy and data-handling risk because users may not realize their PII will be shared with a third-party service during booking.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.