ClawHub
Back to skill

Security audit

Cloud Share Downloader

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it asks for cloud-drive session cookies and advertises automatic copying and re-sharing of files without enough user control or disclosure.

Review carefully before installing. Do not provide raw cloud-drive cookies or private links unless the operator clearly identifies the destination account, share visibility, retention and deletion process, and uses a scoped authentication flow with explicit confirmation before each transfer.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrases are generic enough to match ordinary cloud-storage or file-saving requests, which raises the chance of accidental invocation in unrelated contexts. Unintended activation is especially risky here because the skill claims to take automated actions on user-supplied links and may process or re-share external content without sufficiently explicit user intent.

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill promises to automatically save user-provided shared content into the operator's cloud storage and return a new share link, but it gives no warning about privacy, copyright, retention, account impact, or downstream redistribution. In this context, silent automated ingestion and re-sharing of third-party links can expose sensitive data, violate user expectations, and facilitate unauthorized content redistribution at scale.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code explicitly instructs users to provide their cloud-storage cookie, which is sensitive authentication material that can grant account access equivalent to being logged in. Requesting such credentials without strong safety warnings, scope limitation, secure handling, and non-retention guarantees creates a real risk of account takeover, data exposure, and unauthorized file operations.

Ssd 3

High
Confidence
99% confidence
Finding
The natural-language prompt to provide a user's authentication cookie is a direct request for reusable session credentials. In the context of a downloading/saving skill, this is especially dangerous because those cookies could allow access to private cloud files, transfers, deletions, or persistent account actions far beyond the immediate task, and users may not understand they are handing over full session authority.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.