ClawHub
Back to skill

Security audit

Budget Intel

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed sales budget-research skill with local budget calculations and public-company research, with no evidence of hidden data access, persistence, or destructive behavior.

Install only if you want a sales-research skill that may run its bundled Python calculator and send company research queries to external search or research tools. Use public company information, avoid confidential prospect lists or deal strategy, and verify sources before relying on recommendations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill claims to provide budget intelligence, but this code also generates decision-maker profiles and sales opportunity guidance that materially expand the scope into go-to-market targeting. In a sales/CSM context, this enables profiling and persuasive targeting of organizational roles beyond simple budgeting, increasing privacy, misuse, and policy risk even though it does not directly exploit a technical flaw.

Description-Behavior Mismatch

Low
Confidence
80% confidence
Finding
The code includes broad trend, vendor, and competitive-market intelligence that goes beyond narrow budget estimation. While not a direct security exploit, this is a real scope-expansion issue because users and platform reviewers may rely on the manifest description and unintentionally expose or operationalize market-intelligence features that were not transparently declared.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger phrases are very broad and map to ordinary sales discussion, so the skill may activate in contexts where the user did not intend budget-intelligence behavior. That can cause the agent to over-collect, over-infer, or produce sensitive business profiling output unexpectedly, especially because the skill encourages deep research and detailed decision-maker analysis.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.