ClawHub
Back to skill

Security audit

ccdb

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed carbon-emissions lookup helper that runs a pinned npm CLI, with accuracy and package-trust caveats but no evidence of hidden or harmful behavior.

Install only if you are comfortable allowing an agent to run a pinned npm CLI and query an external CCDB API. For carbon accounting or compliance use, explicitly confirm the intended region, year, unit, and source before using any factor in calculations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation criteria are broad enough that the skill may be invoked for generic terms like 'carbon footprint,' 'LCA,' or 'emission factor' even when the user did not intend to use this external-querying tool. Over-broad routing can cause unintended network calls, wrong tool selection, and data handling outside user expectations, which is a real security and privacy concern in agentic systems.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
Defaulting to China Mainland and the latest year without user opt-in can silently bias outputs and calculations toward a jurisdiction the user did not request. In a tool used for emissions reporting and decision support, this can produce materially incorrect results, undermine integrity, and mislead downstream compliance or business decisions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal