ClawHub
Back to skill

Security audit

Asphalt Driveway Sealing Kit

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only marketing kit with legal-compliance caveats but no executable, hidden, or data-access behavior.

Use this skill as draft marketing support, not legal approval. Before publishing ads or sending SMS, verify license disclosures, warranty wording, environmental claims, HOA and storm-water statements, recipient consent, and opt-out language with applicable law and your messaging platform policies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The compliance audit asserts that the Nevada license number is included 'in every placement,' but the ad set only includes the license number in one headline and one description. In a regulated home-services marketing context, inaccurate compliance attestations can cause downstream users to publish noncompliant ads and falsely rely on the audit as evidence of legal review.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The compliance audit says the copy uses a '3–5 year workmanship warranty,' but the service tiers actually promise 2-year and 3-year workmanship warranties, while 3–5 years elsewhere refers to expected lifespan. This mismatch can mislead customers and internal reviewers, creating legal and reputational risk from inconsistent warranty representations.

Missing User Warnings

Low
Confidence
96% confidence
Finding
The prompt instructs generation of review-request and annual reminder SMS content, including opt-out language only on messages 1 and 5, but does not require prior express consent, disclosure of automated/promotional messaging obligations, or compliance with TCPA/CAN-SPAM/CTIA-style texting rules. In a marketing skill for contractors, this omission can lead users to deploy unlawful or non-compliant SMS campaigns, exposing them to complaints, carrier filtering, fines, and reputational harm.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.