ClawHub
Back to skill

Security audit

Ordercli

Security checks across malware telemetry and agentic risk

Overview

The skill is for a food-ordering CLI, but it documents importing Chrome cookies and browser sessions, which gives it access to sensitive login data.

Install only if you trust the publisher and are comfortable letting ordercli read Chrome login/session data for Foodora. Prefer password-stdin or an isolated browser profile over importing your default Chrome profile, and review how the tool stores and deletes imported sessions before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Content
Cloudflare / bot protection
- Browser login: `ordercli foodora login --email you@example.com --password-stdin --browser`
- Reuse profile: `--browser-profile "$HOME/Library/Application Support/ordercli/browser-profile"`
- Import Chrome cookies: `ordercli foodora cookies chrome --profile "Default"`

Session import (no password)
- `ordercli foodora session chrome --url https://www.foodora.at/ --profile "Default"`
Confidence
88% confidence
Finding
cookies: `ordercli foodora cookies chrome; cookies chrome

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.