ClawHub
Back to skill

Security audit

Maiklubi

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent MyClub helper, but users should treat the account credentials and generated calendar links as sensitive family and schedule data.

Install only if you trust the maiklubi npm package and are comfortable giving it MyClub account access. Use it for authorized family or club accounts only, avoid pasting full notifications, child/member details, invoices, or webcal URLs into public chats or logs, and clear the saved account with maiklubi config clear when access is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill handles sensitive family and club data including events, invoices, notifications, attendance status, and potentially children’s schedules, but it does not clearly warn users or downstream agents to treat this information as private. In an agent setting, missing privacy guidance increases the chance that data is over-shared in summaries, logs, chats, or external tools, creating a real confidentiality risk even though the file does not itself exfiltrate data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill documents creation of calendar subscriptions and notes that it returns a webcal URL, but does not warn that such URLs are effectively bearer secrets that can expose ongoing private event data to anyone who obtains them. In this context, the URL may reveal children’s practice and match schedules, locations, and attendance-related data over time, making accidental sharing especially risky.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.