ClawHub
Back to skill

Security audit

Publish a Webpage

Security checks across malware telemetry and agentic risk

Overview

This skill helps publish a simple webpage to a live hosting service, and its behavior is disclosed and aligned with that purpose.

Install this only if you intend to let the agent publish content to a live goclawgo project. Before deploying, confirm the page does not include private, confidential, regulated, or proprietary information, and treat the goclawgo Agent URL as a project key that should not be shared unnecessarily.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are broad enough to match many ordinary requests about websites, ideas, portfolios, or sharing content online, which increases the chance the skill is invoked when the user did not specifically intend a deployment workflow. Because this skill can guide publication to a live internet URL, accidental invocation can lead to unnecessary collection of deployment credentials and unintended public exposure of content.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill repeatedly instructs the agent to publish content to a live, shareable webpage but does not require a warning that the result will be publicly accessible on the internet. In this context, non-technical users are specifically targeted, which makes the omission more dangerous because they may not understand that personal, sensitive, or proprietary information will be exposed publicly.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.