ClawHub

Ghostfetch

Security checks across malware telemetry and agentic risk

Overview

Ghostfetch is a disclosed web search and page-fetching CLI skill, with privacy caveats around cookies, captcha providers, and building an external binary.

Install only if you trust the pinned ghostfetch source and are comfortable building a local binary. Use --no-cookies for stateless browsing, avoid fetching private/internal URLs or pages containing secrets, and do not provide captcha API keys unless you explicitly intend to use those third-party services.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill states that cookie jars may be persisted, but it does not clearly warn that cookies can contain session identifiers and browsing state that may survive across runs. Persistent cookies create privacy and account-cross-contamination risks, especially in shared agent environments or when the agent later accesses other sites using the same jar.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documented support for third-party captcha-solving services and API keys implies data from challenged pages may be sent to external providers, but the skill does not clearly disclose that sharing. This can expose page content, challenge artifacts, and account-related context to outside services, and it encourages handling of sensitive API credentials without strong safeguards.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal