ClawHub
Back to skill

Security audit

Wishfinity +W

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Wishfinity wishlist integration that mainly shares product links with Wishfinity after a user-facing save flow.

Install this only if you trust Wishfinity and the `wishfinity-mcp-plusw` npm package. Use confirmation for ambiguous requests, and avoid saving product URLs that include private tokens, account-specific identifiers, or other sensitive URL parameters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger guidance is broad enough to fire on common conversational phrases like 'I want this' or 'Remember this product,' which can cause the agent to offer or initiate a save action when the user did not clearly intend to use Wishfinity. In a commerce context, this can create confusing or unwanted state changes, misdirect users into a third-party flow, and increase the chance of accidental data sharing through wishlist links.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.