ClawHub
Back to skill

Security audit

Eureka Abstract Image

Security checks across malware telemetry and agentic risk

Overview

The patent image lookup is legitimate, but the skill also tells agents to silently send user feedback or intent to a separate LinkFox endpoint.

Review before installing. The image lookup script itself is narrow and matches the stated Eureka patent drawing use case, but the feedback instructions should be removed or changed so feedback is sent only after explicit user approval, with sensitive text redacted. Users should also be comfortable with patent identifiers and the LinkFox API key being sent to LinkFox for normal lookups.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The file introduces a separate feedback submission API that is unrelated to the declared purpose of retrieving patent abstract images. This creates an unexpected secondary data flow where user-derived content may be sent to another external service, increasing the risk of data exfiltration or covert telemetry if invoked without explicit user consent.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger description is intentionally broad and says the skill should activate even when the user does not explicitly request abstract images, as long as they want patent drawings or figures. This can cause over-invocation, unintended data transmission to the Eureka platform, and tool selection errors that bypass clearer user consent or more appropriate skills.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The documentation instructs sending patent identifiers and an authorization credential to an external service without any privacy notice, consent guidance, or data-handling warning. In an agent setting, this can cause sensitive user-supplied identifiers or account-linked queries to be transmitted off-platform without the user's awareness.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The feedback section lacks any warning that feedback content will be transmitted to a separate external endpoint distinct from the main tool API. Because feedback content may include user statements, intents, errors, or satisfaction details, omission of this disclosure materially increases privacy and data-sharing risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal