ClawHub
Back to skill

Security audit

Apple Serial Lookup

Security checks across malware telemetry and agentic risk

Overview

This skill performs a straightforward Apple serial-number lookup with local decoding and disclosed web lookup steps, with the main consideration being privacy when sharing a device serial externally.

Installers should treat Apple serial numbers as potentially sensitive asset identifiers. Use the local decoder freely for older serials, but only allow web lookups when you are comfortable sharing the serial with search providers, EveryMac, Apple coverage, or similar lookup services.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs sending a user-provided Apple serial number to third-party sites and search engines without warning that the serial may be sensitive device-identifying information. This can leak identifiers to external services, logs, analytics, and search providers, creating privacy and asset-tracking risks, especially in enterprise or support contexts.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.