ClawHub
Back to skill

Security audit

Craft Locale Checkout

Security checks across malware telemetry and agentic risk

Overview

This is a prompt-only checkout localization guide with broad activation wording but no evidence of unsafe access, code execution, or hidden behavior.

Install this for international ecommerce checkout localization guidance. Use a more specific skill for general shipping, growth, pricing, fraud, or retention strategy, and do not provide store admin access, payment data, or customer records unless a separate trusted integration clearly requires it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger language is intentionally expansive: it says to activate even when users do not explicitly mention localization and includes adjacent topics like translation, multi-currency, duties, and international shoppers "feeling at home." In an agent-routing context, this can cause the skill to over-trigger on general international commerce conversations, leading to irrelevant guidance, misrouting, or crowding out more appropriate skills.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The example-based trigger instruction is underspecified because it treats a broad symptom (international buyers dropping off at checkout) as sufficient activation without requiring evidence that localization is the underlying issue. This can make the skill fire for problems caused by pricing, shipping cost, fraud checks, site speed, inventory, or UX defects unrelated to localization, reducing routing precision and potentially producing misleading recommendations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.