ClawHub
Back to skill

Security audit

Travel

Security checks across malware telemetry and agentic risk

Overview

This travel-planning skill is a simple local organizer that writes travel notes under a disclosed ~/travel/ folder, with privacy considerations for sensitive trip documents.

Install this if you want a local travel-planning folder. Before using it, decide what sensitive details you are comfortable storing in ~/travel/, especially passport, insurance, confirmation, emergency contact, and loyalty account information; prefer partial references over full secret numbers unless you intentionally want them saved locally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill uses very broad natural-language triggers like a user merely mentioning a travel idea or planning a trip, which can cause unintended activation during ordinary conversation. That can lead to surprising autonomous behavior, including creating files or organizing personal data when the user did not explicitly ask for the skill to run.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs creation of a ~/travel/ workspace but does not disclose that it will modify the local filesystem or ask permission first. Even though the directory is user-themed and not inherently sensitive, silent file creation is risky because it violates user expectations and can combine with broad triggers to produce unintended persistent changes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.