ClawHub

小鹿选房

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed real-estate search skill that runs the Xiaolu House CLI and may store a Xiaolu API key locally.

Install only if you trust the Xiaolu House npm CLI and are comfortable letting the agent run it locally for property searches. Use a revocable API key if possible, review outputs from `config --show` before sharing them, and only clear configuration when you intentionally want to remove stored settings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger guidance explicitly treats very broad phrases like '帮我找房' and '我要买房' as invocation cues and instructs the agent to proactively steer the user into the skill. That increases the chance of unintended activation in ambiguous conversations and can cause the agent to enter a transactional real-estate workflow before the user clearly asked for this specific tool.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The configuration section exposes commands that can show user information and modify persistent settings, including API key management, but the skill text does not warn that these commands affect stored account/configuration data. In an agent setting, this can lead users to authorize commands without understanding that sensitive local state may be displayed or changed, increasing privacy and integrity risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal