ClawHub
Back to skill

Security audit

Quotewise semantic quote search via MCP

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Quotewise quote-search integration that uses a remote MCP service and optional API key without evidence of hidden or unrelated behavior.

Install this if you trust Quotewise and the npm tools invoked by npx. Use a dedicated Quotewise API key where possible, remember that configured Authorization headers may be saved by the MCP client, and avoid sending sensitive private text as quote-search queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
83% confidence
Finding
The README instructs users to configure an MCP endpoint with an Authorization bearer token and send requests to a third-party hosted service, but it does not clearly warn that both credentials and quote/query contents will be transmitted off-host. This is not inherently malicious, but it can create privacy and secret-handling risks if agents or users assume the skill is local or do not realize prompts, searches, and API keys are being disclosed to an external provider.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.