ClawHub
Back to skill

Security audit

GEO Pulse — Brand AI Visibility Intelligence

Security checks across malware telemetry and agentic risk

Overview

GEO Pulse is a coherent reporting skill that uses an external API for brand visibility analysis, but users should be careful with confidential brand or client data.

Install only if you trust the GEO Pulse API endpoint. Use public brand and domain information by default, set GEO_PULSE_BASE_URL to a trusted HTTPS service when possible, and confirm before running first-time onboarding for confidential clients, launch names, or sensitive competitive research.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly sends brand-related queries to an external public endpoint but does not disclose this data transfer or obtain user consent. This creates a privacy and data-governance risk because user-supplied brand names, domains, and analysis requests may be transmitted to a third-party service over the network, potentially without the user's awareness.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.