ClawHub
Back to skill

Security audit

Ora外贸客户开发专家

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed external business-search API client that sends user search terms and an Ora API key to its stated service, with no hidden persistence or unrelated behavior found.

Install only if you are comfortable sending company names, product keywords, country filters, and the Ora API key to h.smtso.com. Avoid entering confidential business research terms unless that external lookup is intended, and use an API key scoped to this service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill explicitly states that it will read an API key from an environment variable or a local key file and transmit that credential, along with user search terms, to an external service. If the platform does not declare the required permissions or data access clearly, this creates a hidden secret-access and exfiltration path that can surprise operators and violate least-privilege expectations.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger conditions are broad enough to activate on common business-search requests, which increases the chance that ordinary user prompts will invoke this skill unexpectedly. In this skill's context, accidental invocation is more dangerous because activation can send user-entered company names, product terms, and potentially sensitive business research queries to an external domain.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.