ClawHub

kmong

Security checks across malware telemetry and agentic risk

Overview

This skill is not malicious, but it needs review because it automates real account creation and identity verification using sensitive personal data.

Install or use this only if you intend to create and verify your own Kmong expert account under close supervision. Keep identity fields, CAPTCHA/security characters, SMS codes, Google sign-in, agreement checkboxes, and final registration submission under your direct control, and protect any local secrets file with restrictive permissions and version-control exclusion.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill explicitly instructs collection and entry of highly sensitive identity-verification data, including name, birthdate, partial national ID data, phone number, SMS code, and security characters, but provides no privacy safeguards, consent guidance, minimization rules, or storage restrictions. In an automation context, this is dangerous because it normalizes handling regulated personal data and one-time authentication factors in a reusable skill, increasing the risk of account takeover, identity misuse, and unauthorized retention or exposure of PII.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill tells the agent to take screenshots and read CAPTCHA/security characters from the verification flow, which creates a capture of sensitive authentication content without any warning about image handling, retention, or access controls. This is risky because screenshots may contain verification artifacts and personal data, and using automation to interpret challenge-response mechanisms can also undermine security controls intended to verify human participation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal