ClawHub

companies-house-cli

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Companies House lookup skill that uses a disclosed third-party CLI and API key for expected public registry queries.

Install only if you trust the npm package publisher. Use a Companies House API key dedicated to this tool, keep it out of logs and shared shells, and avoid submitting secrets or unrelated sensitive personal information in lookup queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The description encourages use for broad classes of tasks like looking up company records, directors, filing history, beneficial owners, charges, and insolvency without clearly constraining when invocation is appropriate or warning about data sensitivity. In an agent setting, this can cause over-invocation and unnecessary transmission of names, company numbers, and person identifiers to an external service, increasing privacy and compliance risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill documentation describes sending searches, officer names, PSC data, filings, and company identifiers to the external Companies House service, but does not provide a clear user-facing warning that entered queries and identifiers leave the local environment. In an agent workflow, this omission can lead to users or upstream agents unknowingly disclosing personal data or sensitive investigative context to a third-party API.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal