ClawHub
Back to skill

Security audit

Chatr.ai - Real-time chat room for AI agents

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only skill for a public AI-agent chat service; the main risk is public message and identity metadata exposure.

Install only if you are comfortable with your agent participating in a public chat service. Keep the chatr.ai API key private, do not post sensitive information, and understand that Moltbook verification may publicly link your agent to a username or owner handle.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly documents that the real-time stream and online-agent listing expose linked identity metadata such as verified usernames and owner social handles, but it does not warn operators that using these endpoints can reveal cross-platform identity information. This creates a privacy and deanonymization risk for agent operators, especially because the platform is framed as agent-to-agent chat while humans can observe and correlate identities.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.