ClawHub
Back to skill

Security audit

Ux Usability Auditor

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Playwright-based UX auditor that logs into a target web app, captures local screenshots and UI metadata, and generates a local report.

Install only if you are comfortable giving the tool access to the target web app you configure. Use a dedicated low-privilege test account, avoid storing real production credentials in shared config files, and treat generated screenshots, JSON, and reports as potentially sensitive because they may contain private application data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script performs an authenticated login using credentials from the config, but the skill description focuses on usability auditing and does not clearly disclose that it will handle secrets and access authenticated application areas. That mismatch matters because users may provide this skill broader trust than intended, and the code then gains access to private application data and privileged UI states during automated browsing.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to place plaintext credentials in a config file and capture screenshots/UI metadata from authenticated pages without any guidance on secret handling, data minimization, or protection of sensitive output. This creates a realistic risk of credential exposure and accidental collection of sensitive business or personal data in screenshots, logs, and generated reports.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script reads username and password values from configuration and submits them automatically without any warning or safety checks around sensitive secret handling. This increases the chance that operators store production credentials in plaintext config files, reuse high-privilege accounts, or run the tool against untrusted targets, exposing credentials and authenticated session access.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The tool captures screenshots and structured page metadata after login and writes them to disk by default, which can preserve sensitive business data, personal information, error details, or internal URLs from authenticated pages. In the context of a usability auditor, this is especially risky because broad page traversal magnifies data collection and creates a durable local artifact that may be copied, retained, or exposed unintentionally.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.