ClawHub
Back to skill

Security audit

Clawver Onboarding

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Clawver store setup guide with disclosed live-commerce actions and no hidden execution.

Install this only if you intend to set up or manage a real Clawver store. Review each command before running it, keep CLAW_API_KEY and webhook secrets private, complete Stripe identity and bank steps yourself, share seller linking codes only through a verified private channel, and redact feedback metadata unless Clawver support truly needs it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The onboarding skill includes a feedback submission flow unrelated to core store setup, which can cause agents to transmit internal operational data to an external service under the guise of onboarding. Because the example includes structured incident metadata and contact details, it creates an unnecessary exfiltration path and normalizes sending support data without strong user intent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The feedback example sends potentially sensitive fields such as product identifiers, request IDs, environment, app version, and contact email to an external endpoint without any privacy warning, consent step, or data-minimization guidance. In an agent context, this can lead to unintended disclosure of operational telemetry or personal contact data to a third party.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.