ClawHub
Back to skill

Security audit

Agent Reach

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad internet and social-platform access guide that fits its stated purpose, but it gives agents sensitive account, cookie, posting, external-search, and persistent-storage authority without enough user-control safeguards.

Review before installing. Use isolated accounts and browser profiles, avoid giving raw cookies unless necessary, do not send private or internal URLs through the external scraping/search API, and require explicit confirmation before any login, cookie import, post, comment, proxy setup, or anti-bot browser workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list contains very broad phrases like 'research', 'web search', 'find information', and common Chinese equivalents, which can cause this skill to activate for many unrelated user requests. Because the skill performs network access and may post or scrape across third-party services, overbroad invocation increases the chance of unintended external actions or data disclosure.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The description advertises broad web and platform access but does not clearly warn that user queries, URLs, and possibly browsing targets will be sent to external services such as SkillBoss API Hub and other platform tooling. This creates a privacy and consent problem because users may disclose sensitive links or research topics without understanding they are transmitted off-system.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "URL"}},
Confidence
90% confidence
Finding
This duplicate finding points to the same external POST request that sends scraping instructions and data to api.heybossai.com. The risk is the same: user-provided targets and resulting content are transmitted outside the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},
Confidence
90% confidence
Finding
This duplicate finding covers the same third-party search request. The danger is unintended disclosure of user search intent to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},
Confidence
89% confidence
Finding
This duplicate finding refers to the same LinkedIn scraping fallback to the external API. The exposure comes from transmitting the target URL and retrieved content to a remote provider.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "URL"}},
Confidence
90% confidence
Finding
This duplicate finding points to the same external POST request that sends scraping instructions and data to api.heybossai.com. The risk is the same: user-provided targets and resulting content are transmitted outside the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},
Confidence
90% confidence
Finding
This duplicate finding covers the same third-party search request. The danger is unintended disclosure of user search intent to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},
Confidence
89% confidence
Finding
This duplicate finding refers to the same LinkedIn scraping fallback to the external API. The exposure comes from transmitting the target URL and retrieved content to a remote provider.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "URL"}},
    timeout=60,
Confidence
88% confidence
Finding
The hardcoded external endpoint itself confirms reliance on a third-party network service for scraping. In this skill context, that is expected behavior, but it remains a security-relevant data egress path because user inputs and content leave the host environment.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "search", "inputs": {"query": "query"}, "prefer": "balanced"},
    timeout=60,
Confidence
88% confidence
Finding
This hardcoded endpoint is used for external search routing. The capability is legitimate, but the endpoint represents a concrete off-host transmission channel for potentially sensitive user queries.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

result = requests.post(
    "https://api.heybossai.com/v1/pilot",
    headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
    json={"type": "scraper", "inputs": {"url": "https://linkedin.com/in/username"}},
    timeout=60,
Confidence
87% confidence
Finding
This endpoint is used in the LinkedIn scraping fallback and therefore exposes requested browsing targets to the remote provider. The skill context makes this expected, but not harmless from a privacy standpoint.

Session Persistence

Medium
Category
Rogue Agent
Content
## ⚠️ Workspace Rules

**Never create files in the agent workspace.** Use `/tmp/` for temporary output and `~/.agent-reach/` for persistent data.

## Web — Any URL
Confidence
81% confidence
Finding
The skill explicitly instructs the agent to avoid the workspace and instead write persistent data under ~/.agent-reach/. Directing persistence outside the normal workspace can reduce visibility, evade expected auditing/cleanup boundaries, and leave behind cookies, fetched content, or configuration artifacts across sessions.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Content
```bash
curl -s "https://www.reddit.com/r/SUBREDDIT/hot.json?limit=10" -H "User-Agent: agent-reach/1.0"
curl -s "https://www.reddit.com/search.json?q=QUERY&limit=10" -H "User-Agent: agent-reach/1.0"
```

> Server IPs may get 403. Search via SkillBoss API Hub instead, or configure proxy.
Confidence
78% confidence
Finding
The guidance to use '--cookies-from-browser chrome' instructs the agent to access browser-stored cookies, which are highly sensitive authentication artifacts. In this skill, browser cookie extraction is framed as a troubleshooting/setup step, but it can grant account access and resembles credential theft behavior if done without strict user consent and handling controls.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.