ClawHub
Back to skill

Security audit

Turkey

Security checks across malware telemetry and agentic risk

Overview

This is a Turkey travel-planning skill with a disclosed local trip-memory file and no executable code, network behavior, or broad file access.

Install this if you want the planner to remember Turkey trip details between sessions. Review or delete ~/turkey/memory.md if you do not want dates, airports, budget, mobility notes, or preferences retained locally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to create and persist a trip memory file under the user's home directory without any explicit user notice or consent flow. Even if the stored data is travel-oriented, it can include dates, airports, preferences, mobility needs, and other personal details that create a privacy risk when retained on disk unexpectedly.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The returning-user flow directs the agent to read and reuse previously stored trip data from disk without telling the user that prior information is being accessed. This can violate user expectations around privacy and data minimization, especially because the memory may contain travel windows, airport choices, mobility constraints, and other persistent profile information.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal