ClawHub
Back to skill

Security audit

Competitive Intelligence Agent

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed competitive-monitoring skill; it uses scraping and optional report delivery as expected, but users should configure data sharing and retention carefully.

Install only if you are allowed to monitor the selected sites and platforms. Prefer file-only delivery until you review report contents, use dedicated low-privilege webhook/API credentials, avoid sending sensitive internal strategy to shared channels, and reduce or purge archived raw data and screenshots when they are no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The script performs news and hiring monitoring even though the stated skill description only mentions pricing, social media, reviews, and product changes. This creates scope creep in data collection, which can violate least-privilege and user expectations, and may lead to unauthorized collection or processing of additional intelligence categories.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README promotes continuous scraping, social monitoring, review aggregation, and outbound delivery to Slack, email, and Telegram without warning users about legal, privacy, or third-party terms-of-service implications. In a skill designed to automate collection and redistribution of external data, that omission can lead users to deploy behavior that violates site rules, mishandles personal data, or transmits sensitive intelligence to external services without informed consent.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill is designed to collect potentially sensitive competitive intelligence and forward reports to external channels like Slack, email, or Telegram, but it does not warn users that gathered data will leave the local environment. This creates a real risk of unintended data disclosure, especially if reports include internal pricing comparisons, screenshots, or strategic recommendations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.