ClawHub
Back to skill

Security audit

Digital Product Advisor

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Bluetooth-earbud shopping advisor with limited, user-requested Markdown report saving.

Safe to install for product research. If you export a report, remember it may save your region, budget, preferences, shortlist, and links to a local Markdown file; check the destination path in shared or persistent environments. Verify prices, availability, and seller legitimacy yourself before buying, because the skill is an advisor and should not be treated as checkout approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill instructs the agent to save generated reports to a local path by default, but it does not require explicit user confirmation or warn about local persistence. This can create unintended storage of user preferences, budgets, regions, and shopping intent on disk, which is especially risky in shared or persistent environments.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal