ClawHub
Back to skill

Security audit

Grokipedia

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: search and fetch public Grokipedia articles without credentials, persistence, or local data access.

Reasonable to install for public Grokipedia lookups. Do not use sensitive search terms because queries are sent to grokipedia.com, treat --raw HTML output as untrusted if another tool renders it, and prefer pinned dependencies or a lockfile when reproducible installs matter.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Unpinned Dependencies

Low
Category
Supply Chain
Content
"install": "bun install --production"
  },
  "dependencies": {
    "jsdom": "^24.0.0",
    "@mozilla/readability": "^0.5.0"
  }
}
Confidence
90% confidence
Finding
The dependency uses a caret range, which allows newer minor/patch versions to be installed over time. This creates a supply-chain risk because builds are not fully reproducible and a malicious or compromised upstream release could be pulled in without review.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "jsdom": "^24.0.0",
    "@mozilla/readability": "^0.5.0"
  }
}
Confidence
90% confidence
Finding
The dependency is specified with a caret version range, so installations may resolve to different package versions over time. That weakens reproducibility and increases exposure to accidental regressions or supply-chain compromise from upstream releases.

Known Vulnerable Dependency: @mozilla/readability==0.5.0 — 1 advisory(ies): CVE-2025-2792 (@mozilla/readability Denial of Service through Regex)

Low
Category
Supply Chain
Confidence
86% confidence
Finding
The flagged version of @mozilla/readability has a reported denial-of-service issue via regex processing. In this skill, the package is used to parse article content from an external site, so specially crafted HTML could trigger excessive CPU consumption or degraded availability during fetch/parsing operations, though the overall impact is limited by the skill's read-only nature.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.