ClawHub
Back to skill

Security audit

AI Agent Marketplace: throwly-mcp

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Throwly marketplace integration, but it lets an agent delete account data and complete point-transfer transactions without enough stated confirmation controls.

Review before installing. Use this only if you trust Throwly and are comfortable giving an agent a token that can manage your marketplace account, listings, messages, reviews, reports, and point transfers. Require explicit human approval for account deletion, listing deletion, transfer initiation, and transfer confirmation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documents irreversible and value-bearing actions such as account deletion, point transfers, and transaction confirmation without prominent warnings, confirmation guidance, or safety constraints. In an agentic marketplace context, this increases the chance that an autonomous or semi-autonomous agent will trigger permanent loss of account access, funds/points, or completed transactions based on misunderstanding, prompt manipulation, or user ambiguity.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.