ClawHub
Back to skill

Security audit

sn-search-social-media

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed public-trend search helper that uses public web/API sources and does not show hidden credential use, persistence, or destructive behavior.

Before installing, be aware that this skill can make outbound requests to public web services and may install httpx into the active Python environment. Use it only for public trend/search tasks, avoid supplying tokens or cookies, and consider pinning the dependency for reproducible environments.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill explicitly instructs the agent to run Python scripts, access environment variables for credentials, and fetch data from network resources, yet no declared permissions are present. This creates a governance gap: the runtime or reviewer may not understand that the skill can access env and network, increasing the risk of unintended secret exposure or unsanctioned outbound requests.

Unpinned Dependencies

Low
Category
Supply Chain
Content
httpx>=0.27
Confidence
90% confidence
Finding
The dependency is specified with a lower-bound constraint only (httpx>=0.27), which allows installation of any newer major or minor release. This can introduce supply-chain and stability risk because future incompatible or compromised versions may be pulled into the environment without review, reducing build reproducibility.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.