ClawHub
Back to skill

Security audit

Paprika

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Paprika Recipe Manager helper, with normal privacy and credential-handling cautions for a tool that accesses a personal recipe account.

Install only if you are comfortable letting the agent use the Paprika CLI to read recipes, meal plans, and grocery lists from your Paprika account. Prefer interactive `paprika auth` when possible, avoid storing your Paprika password in shared shells or logs, and verify the npm package source before global installation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The setup instructions tell users to place Paprika account credentials directly into environment variables without any warning about secret handling, shell history exposure, process inspection risk, or safer storage options. In a skill that accesses personal account data, this increases the chance of credential leakage and unauthorized access to recipes, meal plans, and grocery data if the host environment is shared or logged.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.