ClawHub
Back to skill

Security audit

USA Business Migration Planner

Security checks across malware telemetry and agentic risk

Overview

The package name promises USA business migration planning, but the actual skill is a Cambridge-versus-Amazon career decision workflow, with no dangerous runtime behavior found.

Review this carefully before installing: it does not appear to provide USA business migration planning despite that name. It appears to be a low-authority career/education decision template, so the main risk is misleading scope rather than system access or data exposure.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The skill name and manifest context suggest a purpose related to U.S. business migration planning, which implies immigration, relocation, or business-mobility support. However, the README's requirement, evidence, triggers, and implementation description consistently describe a career/education choice workflow unrelated to business migration, indicating a semantic mismatch between claimed scope and actual intended behavior.

Description-Behavior Mismatch

Medium
Confidence
99% confidence
Finding
The manifest name at L02 suggests the skill is for USA business migration planning, but both the manifest description and the workflow content repeatedly describe a decision-support skill for evaluating 'CS masters at Cambridge or start as a new grad at Amazon.' This is a clear semantic mismatch between the skill's claimed identity and its actual documented purpose.

Description-Behavior Mismatch

Medium
Confidence
99% confidence
Finding
The manifest name/title frame the skill as a 'usa-business-migration-planner', which implies U.S. business immigration or relocation planning. However, both the manifest description and the body repeatedly describe helping users decide between a CS master's at Cambridge and starting as a new grad at Amazon, which is a different problem domain entirely.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The document header says 'USA Business Migration Planner', but the requirement section and cited validated demand describe a reusable workflow for choosing between Cambridge master's study and an Amazon new-grad role. This is not merely incomplete documentation; the stated purpose is actively inconsistent within the same file.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.