ClawHub
Back to skill

Security audit

Fiverr Gig Automation

Security checks across malware telemetry and agentic risk

Overview

This skill is open about automating a Fiverr account, but it asks for full login credentials for high-impact marketplace actions without enough safety or secret-handling boundaries.

Review carefully before installing. Only use this if you are comfortable giving an agent browser-level control over your Fiverr account; store credentials in a secure secret store, avoid logging them, require human review before sending offers or messages, and consider a dedicated or limited-risk account.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs users to store Fiverr login email, password, and username in environment-style settings for use with browser automation, but provides no guidance on secure secret handling, least-privilege use, rotation, or storage protections. Because this skill automates full account actions on a financial/business platform, compromise of those credentials could enable account takeover, unauthorized messaging, gig manipulation, or fraudulent activity.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.