ClawHub

Trip Discover

Security checks across malware telemetry and agentic risk

Overview

This is a simple travel-planning skill whose web search and saved-destination memory use are disclosed and aligned with its purpose, with minor usability/privacy caveats.

Safe to install for normal travel planning. Confirm or correct your departure city, especially if you are not traveling from Delhi, and be aware that prompts about saved places or travel preferences may cause the agent to use saved destination memory and web searches containing your trip details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation conditions are broad enough to match many ordinary travel-related queries, making unintended invocation likely. In an agent environment, that can cause the skill to take over conversations, trigger web searches and memory access without clear user intent, and reduce routing reliability or expose more user context than necessary.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
Defaulting the user's origin city to Delhi without confirmation can produce misleading recommendations and implicitly substitutes unstated user data. While not directly exploitable for code execution, it can drive incorrect web queries, travel-time estimates, and personalization behavior based on an assumption the user did not authorize.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal