ClawHub
Back to skill

Security audit

Gamma Presentations

Security checks across malware telemetry and agentic risk

Overview

This is a small instruction-only Gamma integration, with clear external API use but avoidable guidance to store an API key in a local text file.

Install this only if you want an agent to submit content to Gamma on your behalf. Use an environment variable or secret manager for the Gamma API key, avoid TOOLS.md or version-controlled files, and do not send confidential or regulated content unless you are comfortable with Gamma processing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs sending user-provided content to Gamma's external API but does not instruct the agent to obtain user consent or warn that prompts, documents, or slide content will leave the local platform. In an agent setting, this can cause unintended disclosure of sensitive or proprietary data to a third party.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The setup guidance suggests placing the Gamma API key in TOOLS.md, a local file that may be readable, committed, shared, or exposed through tooling. Storing live credentials in documentation-like files increases the chance of accidental credential leakage and downstream API abuse.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.