ClawHub

AudTools Shopify Batch Collector

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed AudTools browser-automation helper, with real operational risk from bulk submissions but no evidence of hidden theft, persistence, or destructive behavior.

Install only if you trust the AudTools workflow and intend to submit every CSV URL to that service. Run a small CSV first, keep the browser visible, and prefer locked installs so Playwright resolves to the package-lock version.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill is explicitly designed to read URLs from a CSV and submit them in bulk to a third-party website, but it does not disclose the privacy, authorization, or data-transfer implications of sending potentially sensitive target URLs to an external service. In this context, the automation also drives login-gated browser interaction and high-volume submission, which increases the risk of unauthorized data sharing, account misuse, or violating the destination site's acceptable-use expectations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script automates repeated submissions to a live third-party service using user-supplied links, but it does not provide a meaningful safety confirmation, dry-run mode, rate-limit guard, or scope validation before performing write-like actions. This is dangerous because broad selectors and automatic iteration can cause unintended mass submissions, misuse of an authenticated session, or accidental abuse of the target service if the CSV is wrong or the page structure changes.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script uses very broad fallback selectors such as generic text inputs, generic buttons, and broad CSS classes, then automatically fills fields and clicks the first matching submit-like control. On a dynamic authenticated site, this can target the wrong form or action if the page layout changes, if a modal appears, or if unexpected content is injected, causing unintended submissions or actions under the user's logged-in session.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"audtools-batch-collect": "./batch-collect.js"
  },
  "dependencies": {
    "playwright": "^1.40.0",
    "csv-parser": "^3.0.0"
  },
  "keywords": [
Confidence
84% confidence
Finding
"playwright": "^1.40.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "playwright": "^1.40.0",
    "csv-parser": "^3.0.0"
  },
  "keywords": [
    "audtools",
Confidence
80% confidence
Finding
"csv-parser": "^3.0.0"

Known Vulnerable Dependency: playwright==1.40.0 — 1 advisory(ies): CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)

High
Category
Supply Chain
Confidence
94% confidence
Finding
playwright==1.40.0

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal