ClawHub
Back to skill

Security audit

Order Analytics

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local order-data report generator, with privacy and third-party resource caveats users should understand.

Before installing, treat order files as sensitive customer/business data. Prefer pseudonymous user IDs instead of raw phone numbers, avoid including unnecessary personal data in generated reports, and consider replacing the CDN Chart.js and Google Fonts references with local assets for confidential or offline reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The template loads Chart.js from cdnjs and fonts from Google Fonts, introducing third-party network dependencies into a report generator that may be expected to work locally and offline. If those external resources are unavailable, tampered with, blocked, or leak access metadata, generated reports can fail or expose user environment information unnecessarily.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README explicitly encourages processing order data that includes user identifiers such as phone numbers or user IDs, but it provides no privacy guidance, minimization requirements, masking expectations, or restrictions on storing/reporting personally identifiable information. In a skill that generates analysis reports and dashboards, this omission increases the chance that sensitive customer data will be uploaded, retained, or displayed in outputs without adequate protection.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrases are broad business-analysis terms that can match many normal user requests, increasing the chance this skill is invoked when the user did not specifically intend to use it. Over-broad invocation can cause unintended processing of uploaded business data and expansion of the skill's access to sensitive order/customer datasets beyond what is necessary.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.