ClawHub

Nox Influencer - Creator Discovery & Influencer Marketing

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed NoxInfluencer CLI helper for creator discovery and marketing operations, with clear approval gates for sensitive writes.

Install only if you intend to let the agent operate your NoxInfluencer account. Review actions before approving sends, schedules, CRM changes, contact exports, unlocks, or downloads, and remember that login stores a reusable local API key.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill metadata description is extremely broad and covers many loosely related marketing, CRM, outreach, export, monitoring, and setup tasks. In agent routing systems, such broad activation language can cause the skill to be selected for requests it should not handle, increasing the chance of unintended execution of high-impact operations like contact retrieval, exports, or messaging workflows.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The 'When to Use' section contains broad triggers like wanting to 'find, evaluate, or contact creators' or needing campaign/CRM/email/export operations, without enough gating criteria. Because this skill can perform operational and potentially sensitive actions, ambiguous invocation guidance raises the risk that an agent will over-apply it to general marketing requests and initiate privileged workflows or expose data unnecessarily.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal