ClawHub
Back to skill

Security audit

Gold Price Report

Security checks across malware telemetry and agentic risk

Overview

This skill fetches gold and silver market prices from a fixed third-party quote API and does not show hidden control, credential access, persistence, or destructive behavior.

Install only if you are comfortable with the skill contacting a third-party quote service for market data. Treat returned prices as external market information that may be delayed or inaccurate.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to run a bundled Python script that fetches real-time quotes from an external source, which implies network access, yet no corresponding permission is declared. This creates a transparency and policy-enforcement gap: operators and sandboxes may not correctly gate or review outbound requests, and users are not clearly informed that external data retrieval occurs.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.