ClawHub
Back to skill

Security audit

Canada

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Canada travel-planning skill that stores trip preferences locally, with no evidence of network access, credential use, hidden execution, or harmful behavior.

Before installing, be aware that the skill may create ~/canada/memory.md and keep travel context there for later conversations. Avoid saving full booking confirmation numbers, medical details, identity documents, or other sensitive information unless you are comfortable keeping it in that local file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs creation and ongoing updates of a persistent user memory file containing travel preferences and constraints, but it does not require any explicit user consent or notice that information will be stored across sessions. This creates a privacy risk because the agent may retain personal data unexpectedly, including budget, dietary, mobility, and travel-planning details that users may not realize are being persisted.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly says to read previously stored user memory silently, which removes transparency about the use of retained personal information. Silent retrieval of stored preferences and constraints can violate user expectations and privacy norms, especially when the data influences responses without the user knowing it was accessed.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.