ClawHub
Back to skill

Security audit

Loan Calculator 贷款真相计算器

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local loan APR calculator; it runs bundled Python scripts for calculations but does not show hidden data access, persistence, network use, or destructive behavior.

Install only if you are comfortable with the agent running the bundled local Python calculator on loan text you provide. The skill appears purpose-aligned and local-only, but agents should pass user input as data with proper quoting or a fixed script entrypoint, not by blindly pasting arbitrary text into a python3 -c string.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly instructs the agent to run local Python code based on user-supplied natural-language input, yet does not tell the user that local code or subprocess execution will occur. Even though the example embeds the input as a Python string literal rather than shelling it directly, this still expands the trust boundary and can expose the host to risks from unsafe parser/report code, dependency abuse, or unexpected file/system access during execution.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.