ClawHub
Back to skill

Security audit

Cabinet Kitchen Marketing Kit

Security checks across malware telemetry and agentic risk

Overview

This is a content-only marketing skill, but its claimed FTC-compliant review templates include satisfaction-gated review requests that users should review before using.

Install only if you are comfortable treating the outputs as draft marketing copy, not legal advice. Before using it, replace all satisfaction-conditioned review asks with neutral honest-review requests, keep referral incentives separate from review solicitations, and confirm state, local, FTC, platform, licensing, and advertising requirements for the contractor's actual jurisdiction.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
Although the prompt states that review-gating must be avoided, multiple templates condition the review ask on satisfaction signals such as 'if everything looks great' or 'if you're happy.' In a reputation-management skill, that framing can systematically steer only satisfied customers toward public reviews while diverting dissatisfied customers into private resolution channels, creating deceptive review selection practices and FTC risk.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill says review requests must have no incentives, but the combined review-plus-referral template places referral compensation language adjacent to the review ask. Even if framed as a referral fee, combining money-related inducements with a review solicitation can confuse recipients and create the appearance that compensation is tied to reviewing, which is risky under FTC endorsement rules.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.