ClawHub
Back to skill

Security audit

OpenMerch Email Verify

Security checks across malware telemetry and agentic risk

Overview

This is a narrow OpenMerch email-verification skill that clearly discloses its external API use, credential requirement, and per-check cost.

Install only if you have an OpenMerch account and are authorized to submit the email addresses you check. Expect each run to send one address and your OpenMerch API key to OpenMerch, consume account credits after the quoted plan step, and possibly fail while the documented provider outage notice remains in place.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The examples encourage sending full email addresses to a third-party service for verification and reputation checks, but they do not clearly warn that this involves transmitting potentially personal data off-platform. Email addresses are personal data in many contexts, so users may unknowingly disclose contact information without understanding privacy, consent, or compliance implications.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
examples.md:17

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:58