ClawHub
Back to skill

Security audit

uexcorp-sc

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate UEXCorp marketplace helper, but it gives agents authority to create, update, and delete remote marketplace records without enough explicit user-control guidance.

Review before installing. Use it only if you are comfortable letting the agent submit market data and change UEXCorp marketplace listings on your behalf. Keep tokens and secret keys out of chat logs, screenshots, and version control, and require the agent to show the exact listing or database change and get your explicit approval before any create, update, or delete action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README advertises features that create trade posts and update the community database, but it does not clearly warn users that these actions send data to an external service and may create or modify remote records. In an agent setting, users may assume a request is informational when it is actually state-changing, which increases the risk of unintended submissions, spam, or disclosure of user-provided market data.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README tells users to place an API token in configuration but provides no guidance on protecting that credential, limiting its scope, or avoiding accidental exposure in logs, screenshots, or version control. Because the token likely authorizes external API actions, poor credential handling could let others read data, post listings, or modify community data through the user's account.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs a destructive DELETE /marketplace_listings flow to replace existing listings, but does not require explicit warning or confirmation before irreversible removal. An agent following this guidance could delete a live production listing unintentionally, causing loss of marketplace presence or forcing manual recovery/recreation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill introduces a separate user secret key for marketplace operations without any warning about sensitivity, storage, or handling. This increases the risk that the agent may solicit, expose, misuse, or persist a credential that likely grants account-linked posting privileges beyond the bearer token.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.