ClawHub
Back to skill

Security audit

Brand Dna Extractor

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do the website brand analysis it advertises, with expected API-key, scraping, VLM-analysis, and optional caching behavior.

Install only if you are comfortable with the agent fetching target websites, sending selected images or derived visual data to Gemini/OpenAI, and storing extracted profiles when Supabase caching is enabled. Use it on public or authorized sites, disable storage for sensitive work, and keep any Supabase service role key strictly server-side, scoped where possible, and out of logs or shared environments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly describes scraping arbitrary websites, sending extracted images to external VLM providers, and optionally caching results in Supabase, but it does not clearly warn users that third-party site content may be transmitted to external APIs and persisted in storage. This creates privacy, compliance, and data-handling risk because users may process copyrighted, sensitive, or restricted content without understanding where it is sent or stored.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation instructs users to set a SUPABASE_KEY labeled as a service role key, but does not warn that this credential is highly privileged and can bypass row-level security. Exposing or casually encouraging use of service-role credentials in general runtime environments materially increases the risk of database compromise, data exfiltration, or destructive writes if the environment is shared or logs are exposed.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.