ClawHub
Back to skill

Security audit

Glasses to Social

Security checks across malware telemetry and agentic risk

Overview

The skill appears useful for turning smart-glasses photos into social posts, but its setup asks users to make a Google Drive photo folder viewable by anyone with the link, which is too broad for potentially sensitive images.

Review the Drive-sharing setup carefully before installing. Use a dedicated folder with only photos you intend to process, avoid making private or workplace images link-public, and manually check every image for faces, minors, screens, IDs, documents, and location details before publishing any generated post.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to analyze photos for scene details, text, and people, then draft social posts, but it does not warn users about privacy, consent, or sensitive information exposure. Smart-glasses images can easily capture bystanders, screens, badges, documents, or location clues, creating a meaningful risk of unintentional disclosure before public posting.

Missing User Warnings

High
Confidence
98% confidence
Finding
The setup tells users to share the Google Drive folder as 'Anyone with link can view,' which weakens access control for a repository of potentially sensitive first-person photos. Even if the link is not intentionally published, link-sharing expands the attack surface and can lead to private image exposure through forwarding, leakage, logs, or accidental reuse.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.