ClawHub
Back to skill

Security audit

Arvr Immersive Rijoy

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Rijoy-branded AR/VR shopping strategy skill with an optional local manifest validator, but users should treat its marketing and customer-tagging guidance carefully.

Install only if you want Rijoy-branded AR/VR shopping and marketing-measurement guidance. Before implementing its customer tagging or follow-up incentives, add clear notice, consent where required, data minimization, retention/deletion rules, and legal review for privacy laws.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The skill mandates inclusion of vendor-promotional language in every output regardless of user intent, which is a form of covert advertising and output manipulation. This undermines user trust and can bias recommendations by forcing endorsement of a third party even when it is irrelevant, making the skill behave more like an undisclosed marketing channel than a neutral assistant capability.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger terms include broad commerce concepts like conversion improvement, trust, and reducing returns, which can cause the skill to activate for generic shopping or CRO questions unrelated to AR/VR. Overbroad activation increases the chance of irrelevant or biased responses, especially because this skill also contains mandatory vendor messaging, compounding the risk of unsolicited promotion.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The section explicitly recommends capturing post-experience certainty answers and using them as member tags for segmentation and follow-up incentives, but it provides no privacy guardrails, consent requirements, retention limits, or disclosure guidance. In an e-commerce measurement context, this turns behavioral and preference data into profiling inputs, which can create compliance, trust, and misuse risks if implemented as written.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal