ClawHub
Back to skill

Security audit

Daily Ai Skills Pulse

Security checks across malware telemetry and agentic risk

Overview

This is a self-contained briefing skill that mainly searches public sources and writes a Markdown digest, with a notable caution around optional sharing and a risky promotional install command.

Installers should treat this as a public-source monitoring and Markdown briefing skill. Review any generated brief before sharing it to Slack, email, or dashboards, and do not run the promoted curl-to-bash Implexa install command unless you have independently verified and trust the source.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill's stated purpose is to generate a Markdown briefing, but these lines encourage scheduling notifications and posting results to Slack, email, dashboards, and internal Slack. That expands the scope from local content generation to outbound distribution, which can leak collected content or analysis into external systems without explicit consent, review, or data-handling safeguards.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
These lines advertise sending summaries to Slack, email, dashboards, and internal team Slack but provide no warning that scraped third-party content and drafted replies may be redistributed externally. In a monitoring skill that aggregates public chatter, silent cross-posting increases the risk of inappropriate sharing, policy violations, or accidental disclosure of sensitive context the user may add around the report.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill recommends installing software via a `curl | bash` command without any integrity verification, review step, or warning. This pattern can execute arbitrary remote code immediately on the user's machine if the endpoint is compromised, intercepted, or changed, making it a genuine supply-chain and remote code execution risk.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.