ClawHub
Back to skill

Security audit

Daily Social Routine

Security checks across malware telemetry and agentic risk

Overview

This skill appears to provide a disclosed social-media check-in workflow, with privacy-sensitive account review and optional logging that users should understand before installing.

Install only if you want an agent to inspect logged-in social media accounts and possibly keep engagement history. Before using persistence, confirm where logs or database entries are stored, how to delete them, and whether you want the skill to run only after an explicit command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes natural-language phrases like "daily social routine," "social media check," and "do my social today," which are broad enough to match ordinary conversation and could invoke the skill unintentionally. Because the skill then performs browser-based checks and proposes actions across multiple social accounts, accidental activation can expose account data or initiate undesired workflows without a clear, deliberate user command.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs browser automation to inspect Reddit, Twitter/X, and LinkedIn activity, and also defines optional database tables and log files for storing account statistics, engagement history, and profile-derived data. There is no explicit privacy notice, consent gate, retention policy, or warning that these actions may collect and persist personal or account-sensitive information, which increases the risk of silent data collection and over-retention.

VirusTotal

No VirusTotal findings

View on VirusTotal