ClawHub
Back to skill

Security audit

Ringg AI

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it says for Ringg AI, but it could initiate outbound phone calls while telling the agent untagged actions are safe read-only operations.

Review before installing. This skill should require explicit confirmation before any `initiate_call` use, including the target number, caller number, assistant, and intended call purpose. Read-only list/get actions are proportionate, but the current documentation under-discloses the outbound-call risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest and top-level description present the skill as suitable for 'searching and reading data', but the documented actions include `initiate_call`, which triggers an external side effect. This mismatch can cause an agent or user to treat the skill as read-only and invoke it in contexts where write-like or real-world actions should require stronger confirmation.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The safety section states that untagged actions are reads and safe to run directly, yet `initiate_call` is left untagged even though it places an outbound call. That creates a direct authorization and safety failure: an agent following the guidance could initiate real-world phone calls without confirmation, potentially causing cost, harassment, spam, or unauthorized contact.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase says to use this skill for 'ANY Ringg AI request,' which is overly broad and can steer an agent into this skill even for operations that need extra scrutiny. In combination with the misleading read-only framing and untagged call initiation, this broad routing language increases the chance of unsafe invocation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.