ClawHub
Back to skill

Security audit

Google全家桶入口

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple Google product launcher that reads a bundled list and opens selected official Google or YouTube pages in the browser.

Before installing, review that the skill opens pages in your normal browser session and that its trigger name "g" is very broad. The bundled destinations are official Google or YouTube HTTPS URLs, and the skill does not appear to collect data or change local files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill opens a URL from product data directly in the user's default browser without validating the destination or constraining allowed schemes/domains. If products.json is modified or supplied from an untrusted source, this can trigger navigation to phishing, malware, or unexpected local/file handler URLs, causing external resource access beyond simple local display.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal