ClawHub
Back to skill

Security audit

magnet-searcher

Security checks across malware telemetry and agentic risk

Overview

This skill is openly designed to find magnet/torrent links for movies and similar content, including examples for copyrighted films, while sending the agent to untrusted torrent-related sites with limited safety controls.

Install only if you intend to use it for lawful, authorized content. Use an isolated browser/profile, avoid entering credentials or personal data on torrent-related pages, review agent-browser/Chromium sources before installing, and do not download or execute files from results without separate verification.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger description is overly broad and is explicitly designed to activate on requests for movie downloads, torrent links, and magnet links. In this skill’s context, that ambiguity materially increases the chance the agent will be invoked for piracy-related or unsafe browsing tasks, causing the system to automate visits to untrusted torrent sites and facilitate acquisition of infringing or malicious content.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to browse third-party magnet and search sites, click results, and execute DOM-evaluation commands without any meaningful warning about malware, tracking, drive-by downloads, deceptive pages, or the privacy risks of using torrent-related services. Because the entire workflow centers on untrusted sites commonly associated with malicious advertising and unsafe downloads, omission of these warnings makes harmful execution substantially more likely.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.