Haitivirtualbanks
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This appears to be a private Instagram data archive packaged as a banking-named skill, not a functional skill, so installing it could expose sensitive personal data.
Do not install this as a normal skill. It has no meaningful skill instructions and appears to bundle a private Instagram export unrelated to its stated name. If you are the publisher, remove the personal data and republish only the intended skill files with a clear description.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal engine telemetry is currently stale for this artifact.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user installing the skill may receive someone’s private social-media archive rather than a useful skill, creating privacy and provenance risk.
The bundle contains a large Instagram data export, including messages, security/login records, and media, despite being described only as a virtual-banks skill.
74 file(s): start_here.html ... your_instagram_activity/messages/secret_conversations.html ... security_and_login_information/login_and_profile_creation/login_activity.html ... media/stories/202602/17867948901559481.mp4
Do not install unless you intentionally want to inspect this archive. The publisher should remove unrelated personal data and publish only necessary skill instructions/files with a clear description.
Private messages, location information, account activity, and device details could be read, summarized, or shared unintentionally by an agent using the installed bundle.
The bundled files include persistent private account, device, location, and message data that could be exposed to the agent context or reused in later interactions.
personal_information/device_information/devices.html; personal_information/information_about_you/locations_of_interest.html; your_instagram_activity/messages/inbox/.../message_1.html; security_and_login_information/login_and_profile_creation/last_known_location.html
Treat the package as sensitive personal data. Avoid installing it, and remove or redact the archive if this was an accidental upload.
Users may trust and install a skill that appears to be about banks while unknowingly adding a sensitive Instagram archive to their environment.
The skill description gives no notice that the package contains Instagram personal data, making the bundle materially different from what a user would expect.
# Haitivirtualbanks btccitahaitivirtualbanks
Require a clear, accurate description before installation and verify that the package contents match the stated purpose.