ClawHub
Back to skill

Security audit

Price Monitor

Security checks across malware telemetry and agentic risk

Overview

This is a coherent price-monitoring skill, but it keeps local tracking records and can optionally schedule scans or send alerts, so users should enable those features deliberately.

Install only if you want the agent to keep local records of competitor product URLs, prices, alerts, history, and reports. Before enabling scheduled scans or external notifications, confirm the interval, destination service, stored file locations, and how to disable the cron job or delete saved monitoring data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
93% confidence
Finding
The skill instructs the agent to persist competitor product URLs, alert settings, and price history into local files without clearly warning the user that this data will be stored on disk. While the data is not highly sensitive by default, it can reveal business intelligence, monitoring targets, and pricing strategy, so undisclosed retention creates a real privacy and operational security issue.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The file instructs the agent to create a recurring cron job that continuously performs scans, generates reports, and writes data, but it does not mention obtaining explicit user consent, disclosing persistence, or warning that this will keep running after the current interaction. In an agent skill context, unattended recurring execution and filesystem writes can surprise users, consume resources, and create a persistence mechanism that outlives the original request.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The configuration recommends sending alerts and reports through Telegram, email, Discord, and potentially Google Sheets without warning that tracked product data, URLs, pricing history, and report contents may be transmitted to third-party services. In a skill that handles user monitoring data, this omission can lead to unintended data sharing, privacy exposure, or compliance issues if users assume notifications remain local.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.