ClawHub
Back to skill

Security audit

Realtime Agent

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only SenseAudio integration that clearly describes its API key use and realtime session lifecycle actions.

Install this only if you intend to let an agent use your SenseAudio API key to start, continue, inspect, and end realtime sessions. Keep the API key and returned tokens server-side, avoid logging them, and bind stored conv_id and room_id values to the correct user or session.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description is overly broad: phrases like "start or manage SenseAudio conversational agents, continue dialogues, or handle room/conv/token lifecycle errors" can match generic requests about conversations or debugging rather than clearly scoped API operations. In agent-routing systems, this can cause the skill to be selected for unintended prompts, increasing the chance of unnecessary credential use, external API calls, or disclosure/manipulation of session identifiers during unrelated tasks.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal