ClawHub

NEAR Content Creator

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a normal NEAR content helper that fetches public market and news data and formats it for user review.

Before installing, be aware that market updates and news digests depend on third-party public data sources and should be reviewed before publishing or relying on them. Use the provided lockfile and install from the expected source.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill appears to rely on network access for market updates, news compilation, and link gathering, but it does not declare any permissions in the manifest. This creates a transparency and policy-enforcement gap: hosts or reviewers cannot accurately assess or constrain what outbound connections the skill may make, increasing the risk of unintended data exfiltration, dependency on untrusted sources, or broader-than-expected network behavior.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal