ClawHub
Back to skill

Security audit

Beestat

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Beestat/ecobee helper that can reveal private home sensor data, but its behavior is disclosed and aligned with its purpose.

Install this only if you trust the external `beestat-cli` npm package and are comfortable giving it a Beestat API key. Treat outputs as private household data because they may reveal room occupancy, temperature patterns, air quality, thermostat details, and HVAC usage history.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill description includes broad trigger phrases like home temperature, thermostat status, air quality, and heating/cooling usage, which are common everyday requests and can cause the agent to invoke this skill more often than intended. Because the skill accesses sensitive household telemetry such as occupancy-related sensor data and indoor environmental data, over-broad invocation increases the chance of unnecessary data exposure or privacy-impacting tool use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The setup instructions require exporting a BEESTAT_API_KEY but provide no warning about secure storage, shell history leakage, access control, or the privacy sensitivity of thermostat and occupancy-adjacent data. In a skill that exposes home environment and sensor information, poor credential handling could enable unauthorized API access and disclosure of household patterns, device details, and air-quality/runtime history.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.