ClawHub
Back to skill

Security audit

Profit Margin Calculator Walmart

Security checks across malware telemetry and agentic risk

Overview

This appears to be a local profit calculator, but it is advertised for Walmart while the code and report output use Amazon/FBA assumptions.

Review carefully before installing or relying on this skill. The main issue is not malware behavior; it is that a Walmart seller may receive Amazon/FBA-based calculations and make pricing or margin decisions from the wrong fee model. Install only after verifying the source and correcting or validating the marketplace-specific formulas.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
This is a real integrity and trust vulnerability: the skill is advertised as a Walmart profit margin calculator, but the implementation uses Amazon referral fees, FBA fulfillment/storage concepts, and Amazon-branded reporting throughout. In a seller-finance context, this can cause users to make pricing and margin decisions based on the wrong marketplace economics, leading to material business loss even though there is no code execution or data exfiltration risk.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The module header and generated reports explicitly identify the tool as an Amazon profit calculator, directly contradicting the skill's Walmart purpose. This makes the mismatch more likely to mislead users and confirms the issue is embedded in user-facing output, increasing the chance of harmful reliance on incorrect calculations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.