ClawHub
Back to skill

Security audit

Analytics

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only analytics guide with purpose-aligned tracking examples, but users should add proper privacy and consent controls before using the snippets in production.

Before installing or applying this skill, treat the code as an example rather than production-ready privacy compliance. Obtain required consent, avoid sending PII or secrets in event properties, prefer pseudonymous identifiers, document what data goes to PostHog, and configure retention/anonymization appropriately.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill provides copy-pastable analytics code that sends user IDs and event properties to a third-party service, but it does not pair that implementation guidance with concrete consent, disclosure, data-minimization, or sensitive-data handling requirements. In context, this is more concerning because the skill is explicitly designed to help users set up tracking, so operators may adopt the sample as-is and unintentionally deploy privacy-noncompliant telemetry or leak identifiers and business data to an external processor.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.