ClawHub
Back to skill

Security audit

Hostinger VPS Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for VPS optimization, but its bundled one-click script can make immediate system and firewall changes without safeguards.

Review the script before use and run it only on a VPS where you are prepared for kernel/network/firewall changes. Confirm SSH and required application ports are allowed, take backups or snapshots first, and prefer a dry-run or manual step-by-step application in production.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrases are broad enough to match ordinary user requests about Hostinger or VPS optimization, which can cause unintended activation of the skill. Because this skill advertises system tuning, security hardening, and one-click optimization, accidental invocation could lead to configuration-changing guidance being surfaced when the user did not explicitly request this specific skill.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The read_when condition activates on any message containing 'hostinger VPS', which is overly permissive and likely to fire during normal discussion rather than an explicit request to use the skill. In context, this is more dangerous because the skill is oriented toward applying infrastructure and security configuration changes, so ambiguous activation increases the risk of inappropriate or premature operational guidance.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill description emphasizes performance and cost savings but does not clearly disclose that it may alter sysctl values, web server settings, firewall rules, fail2ban behavior, or other system configuration. This omission can mislead users about the operational and security impact of using the skill, increasing the chance of unreviewed changes to production VPS environments.

Static analysis

No suspicious patterns detected.