ClawHub
Back to skill

Security audit

Content Repurposer

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it sends user-provided text to MiniMax to generate marketing rewrites and saves the results locally.

Install only if you are comfortable providing a MiniMax API key and sending the text you submit, including any @file contents, to MiniMax/OpenClaw for generation. Avoid confidential, regulated, or secret material unless external processing is approved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that it uses the MiniMax API via OpenClaw for generation, which implies user-provided content is transmitted to a third-party service, but it does not clearly warn users about that data sharing. This creates a privacy and data-handling risk because users may submit proprietary, personal, or sensitive content under the assumption processing is local or first-party.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends user-provided content verbatim to a third-party API, but the CLI gives no clear consent or warning that potentially sensitive input may leave the local environment. In an agent/skill context, this matters because users may pass emails, drafts, or proprietary text via arguments or @file input without realizing the content is transmitted externally.

Ssd 2

Medium
Confidence
88% confidence
Finding
User-controlled content is interpolated directly into the prompt without delimiting or defensive framing, so adversarial text can contain instructions that compete with or override the intended task. In this script the impact is limited because the model output is not executed, but prompt injection can still cause policy bypass, malformed outputs, refusal, or leakage of nearby prompt text and reduce trustworthiness of generated content.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.