ClawHub
Back to skill

Security audit

电商工具箱

Security checks across malware telemetry and agentic risk

Overview

This skill is an e-commerce assistant that uses public market searches and LLM-generated copy, with disclosed but lightly scoped recurring monitoring behavior.

Before installing, treat this as a helper for public e-commerce research and generated sales content. Confirm any recurring competitor monitoring or daily report setup yourself, and do not provide store credentials unless a separate trusted tool explicitly requires them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The invocation examples are broad and generic, which can cause the skill to trigger in situations beyond the user's clear intent. In an agent environment, ambiguous activation increases the chance of unintended web searches, content generation, or scheduled monitoring actions being performed without sufficient scope confirmation.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The opening description markets the skill as handling the full shop-opening workflow, creating an expectation of broad autonomy without defined limits. This can lead an orchestrating agent to over-delegate decisions or actions to the skill, increasing the risk of unintended behavior and user confusion about what the skill is authorized to do.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.