ClawHub
Back to skill

Security audit

Chimney Sweep Fireplace Kit

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only marketing prompt kit with no executable behavior, but users should verify its compliance claims before using generated ads publicly.

Install risk is low from a security perspective because this skill is prompt content only. Before using its outputs in public ads, review generated review-count, star-rating, certification, licensing, and local burn-advisory claims against the contractor's actual credentials and jurisdiction.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The prompt contains contradictory instructions: it explicitly forbids '5-star' language under FTC 2023 review rules, then later instructs the model to generate a trust headline using '[REVIEW_COUNT] 5-Star Reviews'. This conflict can cause the model to output non-compliant advertising copy, creating legal and platform-policy risk for deceptive or prohibited review claims.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The prompt correctly gates CSIA certification claims when the status is 'in training', but multiple later templates still hardcode 'CSIA Certified' wording in headlines, descriptions, bylines, and post text. This can lead the model to produce false credential claims, exposing the business to consumer deception, advertising compliance violations, and reputational harm.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The skill hard-codes Southern Nevada / Clark County-specific compliance language as mandatory for all wood-burning fireplace marketing, but the skill is presented as a general contractor marketing kit rather than a Nevada-only tool. This can cause users in other jurisdictions to generate misleading or legally inaccurate content, creating compliance, trust, and business-risk issues if the model applies irrelevant local rules outside the intended geography.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.