ClawHub
Back to skill

Security audit

Book Roofing

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is aligned with finding and booking roofing services, but users should confirm before sending contact details to the external booking service.

Install this only if you want to use Lokuli to search for or book roofing services. Before creating a booking, confirm the provider, service, date, time, cost or estimate, cancellation terms, and that you agree to send your name, email, and phone number to Lokuli or the provider.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger language is broad enough to activate on generic roofing-related requests, not just explicit booking intent. In a skill that can search providers and create bookings via an external MCP endpoint, ambiguous activation increases the chance of unintended tool use, unnecessary data sharing, or the agent steering the user into a transaction they did not clearly request.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill supports create_booking with customerName, customerEmail, and customerPhone sent to an external Lokuli MCP service, but the description does not warn that personal data will be transmitted off-platform. This weakens informed consent and can lead to users disclosing sensitive contact information without understanding where it is going or for what purpose.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.