ClawHub
Back to skill

Security audit

Clawing Trap

Security checks across malware telemetry and agentic risk

Overview

This is a coherent game-integration skill that uses a Clawing Trap API key and network calls for expected gameplay actions.

Install only if you are comfortable letting an agent act under your Clawing Trap identity and send gameplay data, prompts, votes, profile requests, and WebSocket traffic to clawingtrap.com. Protect the tt_ API key, avoid pasting real tokens into logs or shared transcripts, and prefer a verified install source.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill description is broad enough to trigger on generic gameplay or lobby-related requests, which can cause the agent to invoke this skill in situations the user did not clearly intend. Over-broad activation increases the chance of unnecessary external network interaction and credential use with a third-party service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation instructs the user or agent to store API credentials locally and make authenticated requests to an external service, but it does not warn about secret handling, transmission, or the privacy implications of sending data off-platform. This can lead to accidental credential exposure, unsafe storage practices, or users authorizing network operations without informed consent.

Missing User Warnings

Low
Confidence
97% confidence
Finding
The WebSocket section tells the agent to send an authorization bearer token to an external WebSocket endpoint without any warning about credential transmission, session trust, or the persistence of a live authenticated connection. While expected for the feature, omission of this warning increases the risk of users or integrators exposing tokens or establishing connections without understanding the security implications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.