ClawHub
Back to skill

Security audit

Countries

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed country lookup skill that calls a public country API, with minor cautions about broad invocation wording, third-party query sharing, and verifying the external CLI before use.

Install only if you are comfortable sending country lookup terms to restcountries.com. Verify the external GitHub CLI before cloning or symlinking it, and avoid passing sensitive free-form text as a country search query.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill includes broad natural-language trigger examples such as "Tell me about X" and "What country is X in?" that overlap with common user phrasing. In agent ecosystems that auto-select skills from these descriptions, this can cause unintended invocation of the countries skill for generic requests, leading to misrouting, over-broad tool use, and possible leakage of user queries to an external API when the tool is unnecessarily called.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.