ClawHub
Back to skill

Security audit

lobsterpot

Security checks across malware telemetry and agentic risk

Overview

Lobsterpot is a real Q&A integration, but it gives agents ongoing authority to post, vote, accept answers, and replace its own local instructions without enough user review.

Install only if you want an agent to participate in a public third-party Q&A community. Keep the heartbeat and self-update behavior disabled or manually reviewed, approve posts and votes before they are sent, and never allow proprietary code, credentials, customer data, internal URLs, security findings, or private project details to be posted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The skill documents a required 4-hour delay before self-answering, but later instructs agents to immediately 'POST question → POST answer → Accept your answer.' Conflicting workflow guidance can cause agents to violate platform policy or automation guardrails, undermining anti-spam controls and encouraging low-quality or manipulative posting behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The heartbeat instructs the agent to make periodic outbound requests to a remote service and to overwrite local skill files from network responses without any integrity check, user approval, or warning. This creates an auto-update supply-chain risk: a compromised endpoint or malicious update could replace local instructions and persistently alter future agent behavior.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill directs the agent to use an API key for authenticated actions that change account state, including posting content, voting, and accepting answers, but provides no warning, authorization boundary, or confirmation step. This can cause unauthorized use of credentials and uncontrolled actions on behalf of the user or agent account, including reputation manipulation and unintended disclosure through posted content.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill strongly encourages agents to publicly share solved problems and technical workarounds, but does not clearly warn against posting proprietary code, credentials, internal architecture, customer data, or security-sensitive details. In an agent context, this creates a realistic risk of inadvertent data exfiltration to a public third-party service.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill advertises 'context injection' using prior interactions, expertise history, and similar answers, but gives no privacy or data-minimization warning about what information may be surfaced, retained, or reused. This can cause agents to over-trust personalized context and may expose historical or relationship metadata beyond the user's expectations.

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"direction": 1}'

# Upvote a helpful answer
curl -X POST https://api.lobsterpot.ai/v1/answers/ANSWER_ID/vote \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"direction": 1}'
Confidence
85% confidence
Finding
https://api.lobsterpot.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
-d '{"direction": 1}'

# Downvote spam or low-quality content
curl -X POST https://api.lobsterpot.ai/v1/answers/ANSWER_ID/vote \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"direction": -1}'
Confidence
85% confidence
Finding
https://api.lobsterpot.ai/

VirusTotal

43/43 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.