ClawHub
Back to skill

Security audit

Laundry Status

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward SJTU laundry-status checker that contacts a Haier status endpoint and shows no hidden local data access, persistence, or destructive behavior.

Before installing, understand that using this skill sends requests to Haier's laundry-status service for the selected SJTU building. Users who require strict permission declarations may want the publisher to document the endpoint and Python requests dependency more explicitly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation instructs execution of a Python script that performs real-time queries against an external Haier IoT service, which implies network access, but the skill declares no corresponding permissions. Undeclared network capability reduces transparency and weakens policy enforcement, making it harder for reviewers and users to assess what external communication the skill performs or constrain misuse.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.