ClawHub
Back to skill

Security audit

Bet Slip Parser

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward bet-slip parser with some privacy and accuracy caveats, but it does not show hidden access, exfiltration, persistence, or account actions.

Install this only if you want an agent to turn bet slips or betting descriptions into structured JSON. Review the output before using it for records, and redact account numbers, balances, personal identifiers, or unrelated screenshot content before sharing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill includes explicit bash/Python command snippets for odds conversion even though the skill’s purpose is text/image parsing. In an agentic environment, documentation that normalizes command execution can cause the agent to invoke shell unnecessarily on user-controlled input, expanding the attack surface to command execution and tool misuse.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The validation section again instructs use of shell utilities and Python for checking odds, stake, and payout. Because these commands operate on variables derived from parsed content, they encourage execution paths unrelated to a parsing-only skill and create avoidable risk from unsafe tool invocation.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The description and usage language are broad enough that ordinary conversation about bets could trigger the skill unintentionally. Over-broad activation increases the chance the parser runs on unrelated content, which is especially risky when the skill also contains instructions encouraging shell-backed processing.

Vague Triggers

Medium
Confidence
90% confidence
Finding
Examples like 'I just bet...' or 'I placed a bet on...' are ambiguous and could match normal conversational statements rather than a request for parsing. This can lead to unintended invocation, unwanted extraction of user data, and accidental propagation of content to downstream tooling.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.