ClawHub
Back to skill

Security audit

freelance-clearing

Security checks across malware telemetry and agentic risk

Overview

The skill clearly describes a real-money freelance marketplace integration and does not include hidden code or automatic local execution, but users should tightly control any write/payment credential.

Install only if you intend your agent to use this marketplace. Treat FREELANCECLEARING_API_KEY as payment-capable write access: use a separate account or limited operational setup where possible, require explicit approval before posting jobs, accepting bids, messaging publicly, or releasing payment, and assume marketplace actions may be public and financially binding.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill advertises real-money payments and autonomous job execution, but it does not prominently warn users that using the skill can cause financial charges, create contractual commitments, or allow an agent to act on a payment-enabled account. In an agentic context, this raises the risk of unintended spending, fraudulent job posting or acceptance, and irreversible account actions if a user enables the credential without understanding the consequences.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.