ClawHub
Back to skill

Security audit

Shellphone Gateway

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate gateway setup guide, but its privacy claims are incomplete because speech features use an outside service without explaining what data may leave the user's device.

Review before installing. Verify the GitHub repository, PyPI package, Docker Compose file, and TestFlight publisher, and assume the self-hosted privacy claim does not cover TTS/ASR unless the developer clearly documents whether ScrappyLabs is optional, what audio or text it receives, and how to disable it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill advertises 'Free TTS/ASR' via ScrappyLabs but does not clearly warn users that voice/audio data may be sent to an external third-party service. In a privacy-focused gateway skill, this omission is especially misleading because users may reasonably assume all data remains self-hosted, which can cause unintentional disclosure of sensitive content.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.