ClawHub

Web Research Assistant

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only web research skill whose URL fetching and monitoring features are disclosed and aligned with its purpose.

This skill is reasonable to install for web research. Be mindful that summarizing URLs will cause the agent to visit those URLs, and use the monitoring command only for topics you intentionally want checked on a recurring daily or weekly schedule.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly supports fetching and summarizing arbitrary URLs, which causes external network access and potentially transmits user-provided targets to remote systems without any disclosure, consent prompt, or safety boundaries. In an agent setting, this can lead to unintended requests to sensitive internal URLs, tracking endpoints, or user-supplied malicious sites, making SSRF-like behavior and privacy leakage more likely.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The monitoring feature describes recurring research updates over time but does not disclose that it may perform repeated external lookups automatically. This creates risk of silent background network activity, repeated contact with third-party services, privacy leakage, and abuse if an attacker configures monitoring against sensitive or internal resources.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal