ClawHub
Back to skill

Security audit

academic-email-finder-kiran

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed one-shot tool for finding public academic emails from a user-provided spreadsheet, with privacy and overwrite cautions but no hidden execution or persistence.

Install only if you have a legitimate reason to collect these academic contact emails. Before running it, confirm the source spreadsheet, the row scope, and the output column, and ask the agent to save to a new file rather than overwrite the original. Review a sample of matches because same-name academics can be misidentified.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases are broad enough to activate on ordinary requests about email lookup or academic contacts, which can cause the skill to run in contexts the user did not clearly intend. Because this skill performs bulk search and personal-data collection, accidental invocation increases privacy risk and the chance of unauthorized mass harvesting.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly enables bulk collection of individuals' email addresses from the web and writes results back into the source spreadsheet, but it does not prominently require user confirmation, warn about privacy/legal constraints, or default to creating a separate output file. In this context, the combination of mass PII harvesting and in-place file modification makes accidental misuse, data-protection violations, and destructive overwrites materially more likely.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.