ClawHub
Back to skill

Security audit

E Commerce Find Skills

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed helper for searching, installing, and updating e-commerce skills, but those installs or updates can change the local agent environment.

Install only if you want LinkFox marketplace search and skill installation behavior. Before installing or updating anything, confirm the exact skill slug and target directory, review the skill being installed, and be cautious with global updates because they can change existing agent behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

High
Confidence
95% confidence
Finding
The skill metadata says it 'must trigger' for broad e-commerce and skill-search terms, which can capture many ordinary user requests that do not actually require marketplace search or installation actions. This creates overreach risk: the agent may invoke this skill in unrelated contexts and steer users toward external skill discovery or local installation without sufficiently specific intent.

Vague Triggers

High
Confidence
97% confidence
Finding
The activation section mandates use in ambiguous scenarios like general e-commerce tasks needing 'tool assistance' and bulk skill updates, without clear boundaries. In practice this can cause unintended invocation and privilege expansion, especially because later steps direct command execution and package installation into agent environments.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to install packages into local agent directories such as ~/.claude or workspace paths, but does not clearly warn that this changes the filesystem and agent behavior. That increases the chance of unreviewed persistence or unsafe installation of third-party skills into trusted execution locations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The update instructions encourage running global or targeted updates without warning that existing installed skills will be modified in place. This can silently alter trusted behavior, introduce breaking changes, or pull in malicious updates if the source is compromised.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.