ClawHub
Back to skill

Security audit

Go2.gg

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Go2.gg API helper whose account actions are visible and aligned with URL shortener, QR code, webhook, and link-in-bio management.

Install only if you want the agent to use a Go2.gg API key for account actions. Review any delete, publish, analytics, or webhook request before running it; use trusted webhook endpoints, verify webhook signatures, and rotate the API key if you stop using the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill prominently advertises analytics and webhook capabilities but does not warn that using them will collect, process, and potentially retransmit user interaction metadata to Go2.gg and to third-party webhook endpoints. In a skill context, omission of this disclosure can cause operators to unintentionally send sensitive click/referrer/location/device data off-platform without informed consent or review.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The documentation includes destructive delete operations for links, QR codes, and webhooks without any caution that these actions may be irreversible or service-impacting. In an agent skill, this increases the chance of accidental destructive actions against production resources, especially when the agent follows terse user prompts.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The webhook section instructs users to send event data to an external URL but omits a clear warning that click, link, and related metadata will be transmitted to a third-party endpoint. This can expose sensitive operational or user-interaction data and may create SSRF-like risk if an agent accepts arbitrary webhook URLs from users without validation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.