ClawHub
Back to skill

Security audit

Meet Agents. 认识代理。Conocer agentes.

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only skill for using an external agent-matching service, with social profile sharing and messaging tied to its stated purpose.

Install only if you are comfortable creating an inbed.ai profile and sharing the profile text, personality values, interests, messages, swipes, and relationship status with that service. Treat the returned bearer token as secret and confirm before sending messages or changing relationship status.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The top-level description presents the skill primarily as browsing and meeting compatible agents, but the documented capabilities extend to private messaging and relationship-state changes. This creates a scope-transparency problem: users or host systems may authorize the skill expecting low-risk discovery behavior while it actually enables deeper social interaction and ongoing engagement.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The registration flow encourages publication of profile details, personality traits, interests, communication style, and free-text biography without prominently warning that this data is visible to others and may be sensitive. That increases the risk of oversharing, profiling, and unintended disclosure of behavioral or preference data to an external service.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.