ClawHub
Back to skill

Security audit

AI Opportunity Radar — Discover What In Your Life Should Be Automated

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only reflection skill that openly uses chat check-ins and memory to suggest automation ideas, with privacy considerations but no hidden code or privileged access.

Install this only if you are comfortable with the assistant remembering high-level patterns about your routines, frustrations, workflows, and intentions for recurring reflections. Avoid sharing sensitive personal, work, financial, or health details unless you want them considered in future insights, and disable schedules or clear memory when you no longer want ongoing check-ins.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill is framed as a general conversational companion that learns from casual daily chat, with broad prompts like 'simply talk about your day' and repeated check-ins. That creates a real risk of unintended activation or over-collection of sensitive personal information because users may not realize ordinary conversation is being persistently analyzed for workflow, habits, and automation opportunities.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description promotes ongoing observation, memory, and scheduled check-ins without a prominent privacy warning or consent language. In context, this is more dangerous because the skill is explicitly designed to infer patterns from daily life over time, which can lead users to disclose routines, frustrations, work habits, or other sensitive information without understanding the persistence and surveillance-like nature of the feature.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The description advertises an always-relevant, casual conversational role ('helps users discover automation opportunities through casual daily conversations'), which can cause the skill to appear applicable during ordinary user dialogue rather than only during clear, intentional invocation. That increases the risk of overbroad activation, unintended data capture, or participation in sensitive conversations where the user did not mean to engage this skill.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.