ClawHub
Back to skill

Security audit

Lead Research & BANT Rating

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward sales research assistant that uses public web searches to produce lead qualification reports, with no hidden installation, persistence, or mutation behavior found.

Install this if you are comfortable with the agent using public web search for prospect research. Avoid providing confidential go-to-market plans, private customer lists, or sensitive product details unless you are comfortable with that context being included in search queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes broad, everyday terms such as company names plus generic words like '研究'/'分析'/'评估' and '线索'/'客户研究', which can cause the skill to activate outside the user's intended scope. In an agent environment, over-broad activation can lead to unnecessary web searches and processing of business context, increasing the risk of unintended data handling and incorrect task routing.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The workflow instructs the agent to perform multiple web searches using user-provided company names, domains, and optional product context, but it does not clearly warn that this information may be sent to external search providers. This can create an avoidable transparency and privacy issue, especially when users submit prospect lists or sensitive go-to-market context expecting only local analysis.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.