ClawHub
Back to skill

Security audit

Ultimate Research

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed research-routing skill that uses memory and web research broadly, with no evidence of hidden installation, exfiltration, destructive behavior, or privilege escalation.

Install this only if you want a research orchestrator that may consult prior memory and external web sources whenever the skill is used. Avoid sensitive prompts unless you are comfortable with that behavior, and review the named dependent skills separately because this artifact routes work to them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description is extremely broad and explicitly targets 'every query' in ambiguous or multi-domain situations, which can cause over-triggering on ordinary requests. That creates a security and safety risk because the skill then forces unnecessary use of memory, web scraping, and multiple downstream tools on prompts that may not need them, expanding data exposure and tool-execution surface.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill mandates use of memory and web-scraping components on every routed query without any explicit notice, consent, or minimization language. This is dangerous because users may unknowingly have prior context retrieved or external sites accessed for queries that could contain sensitive information, causing avoidable privacy leakage and unnecessary third-party data exposure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.