ClawHub
Back to skill

Security audit

ssq-analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed lottery-analysis tool with a documented paid recommendation flow, and its payment-order helper is proportionate to that stated purpose.

Install only if you are comfortable with a lottery-analysis skill that fetches public draw data, writes a local database/report, and uses clawtip payment metadata for paid recommendations. Free analysis does not require payment variables; paid use requires configuring the clawtip recipient address and SM4 key.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
This script performs payment-order creation and consumes payment-related environment variables even though the skill is presented primarily as a lottery analysis tool. That mismatch increases supply-chain risk because users or reviewers may grant execution trust expecting data analysis, while the code actually writes payment artifacts and handles payment configuration, creating an opportunity for unexpected billing-related behavior or misuse of host-side secrets.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file header and behavior show that this script is focused on creating local payment order files rather than performing SSQ analysis, which conflicts with the advertised purpose of the skill. Functionality mismatch is dangerous in an agent skill because it can mislead operators, hide non-obvious side effects, and reduce scrutiny around code that initiates payment-related workflows.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.