ClawHub

realestate-advisor

Security checks across malware telemetry and agentic risk

Overview

This markdown-only skill is a real-estate analysis assistant whose web searches and optional screenshot use match its stated purpose, with privacy cautions for property details.

Before installing, understand that the skill may search online real-estate sources and analyze property details or screenshots you provide. Redact unnecessary personal information, exact addresses, listing IDs, agent contacts, and private pricing strategy from screenshots, and verify important estimates against primary real-estate sources before making financial decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are broad enough to match ordinary real-estate conversation, which can cause the skill to activate unexpectedly and begin a workflow involving external data collection. In this skill’s context, unintended invocation matters because it is designed to automatically search online sources and process user-provided housing details, increasing privacy and consent risks even if the author’s intent appears product-focused rather than malicious.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill says it will 'automatically search transaction/listing/market data' and invites users to upload Lianjia/Beike screenshots, but it does not clearly warn users up front that network searches will occur or that uploaded screenshots may contain sensitive personal or property information. This creates a transparency and informed-consent gap that is more serious here because real-estate screenshots can expose addresses, listing IDs, agent details, pricing strategy, and other private data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal