ClawHub
Back to skill

Security audit

H1B Sponsor Finder

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed H1B sponsor research helper and does not request local access, credentials, persistence, or code execution.

Reasonable to install for H1B sponsor research. Avoid putting unnecessary personal details into queries, and treat results as research leads because historical filing data may be delayed, incomplete, and not a guarantee of current sponsorship or hiring.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
The README says the skill supports natural English and Chinese queries, which is a natural-language policy concern because it limits language/locale behavior without presenting it as a user choice. This is not framed as an opt-in or clearly justified region-specific constraint.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.