ClawHub
Back to skill

Security audit

weibo realhot

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Weibo hot-search scraper that opens a browser to fetch public trend pages, with no evidence of hidden data access, persistence, or exfiltration.

Install only from trusted sources, prefer the built-in Weibo category options, and use custom URLs only when you intentionally want the local browser to visit that page. Keep scraping frequency reasonable and check that your use complies with Weibo's terms and your local policy.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The script accepts a user-supplied --url and passes it directly to Selenium's driver.get() with no allowlist or scheme/domain validation. In an agent or automation context, this can be abused for server-side browsing/SSRF-style behavior, access to internal web interfaces, or navigation to hostile pages that exploit the browser/runtime, which is riskier than the stated narrow purpose of scraping Weibo hot-search pages.

VirusTotal

41/41 vendors flagged this skill as clean.

View on VirusTotal