ClawHub
Back to skill

Security audit

OpenPet

Security checks across malware telemetry and agentic risk

Overview

OpenPet is a disclosed virtual-pet chat game; its local pet records, scheduled stat decay, and platform alerts fit that purpose, though operators should disclose and control them clearly.

Install only if you are comfortable with a chat game that keeps local per-user pet files and may run a recurring decay/reminder job. Operators should document what identifiers are stored, where pet files live, how users can delete/reset their data, and how proactive alerts can be disabled or rate-limited.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly stores persistent platform-specific identifiers and owner metadata in per-user JSON files, but the description provides no user-facing warning or consent language about this retention. This creates a privacy risk because users may not expect long-term storage of Discord IDs, phone numbers, chat IDs, usernames, and platform labels in local files tied to gameplay.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill is designed to send proactive alerts and status messages back to users on external messaging platforms, but this behavior is not disclosed in the skill description. Undisclosed outbound messaging can surprise users, create spam/notification risks, and may violate operator expectations or platform policy if enabled without consent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.