ClawHub
Back to skill

Security audit

ClawHarbor

Security checks across malware telemetry and agentic risk

Overview

This skill openly delegates user-described tasks to an external ClawHarbor service, so the main risk is intentional data sharing rather than hidden local behavior.

Use this only for tasks you are comfortable sharing with ClawHarbor and its human agents. Redact passwords, tokens, personal information, confidential business material, proprietary source code, and regulated data before submitting, and review the task summary, price, and Stripe payment link before paying.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The README explicitly encourages delegation of essentially any natural-language task to an external agent, but it does not define boundaries, approval criteria, or categories of prohibited or sensitive work. In an agent skill context, this can lead to unsafe autonomous exfiltration of user data, execution of unvetted third-party workflows, or delegation of actions beyond the user’s expectations.

Missing User Warnings

High
Confidence
94% confidence
Finding
The README states that the agent submits tasks to a third-party service and receives results back, but it does not prominently warn that user prompts, attached context, or derived sensitive information may be transmitted outside the local agent environment. Because this skill is specifically designed for external delegation, the absence of a clear data-sharing warning materially increases the risk of accidental disclosure of confidential, personal, or proprietary information.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill explicitly markets delegation of 'any task describable in natural language,' which creates an extremely broad exfiltration and misuse surface. In an agent setting, this can encourage sending arbitrary user prompts, potentially including secrets, regulated data, or unsafe requests, to an unauthenticated third-party human-backed service without meaningful scope restrictions.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill repeatedly instructs users to send task descriptions to ClawHarbor and notes that tasks are processed by human agents, but it never warns against including sensitive, personal, or confidential information. Because the service is external, unauthenticated, and human-accessed, omission of a clear data-handling warning materially increases the risk of privacy breaches, data leakage, and unintended disclosure of confidential information.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.