ClawHub
Back to skill

Security audit

Automation Suggestion

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill suggests automations from recent task patterns and does not install code or request unusual system access.

Before installing, confirm you are comfortable with the skill using recent task history and message wording to decide when to suggest automations. Prefer installations that let you disable sentiment-based triggers and clear or limit stored suggestion history.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly states it will track suggestions and outcomes in memory for learning, which creates a behavioral record of user activity without any stated notice, consent, retention limit, or data minimization. In a post-task integration that reads task history, this can silently expand monitoring of user behavior and preferences beyond what is necessary to provide a one-time suggestion.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill performs sentiment analysis on user messages to infer frustration, but it does not disclose that message content will be analyzed for behavioral inference. Even though the analysis is described as simple keyword-based, it still processes user communications for secondary purposes and can misclassify or over-collect sensitive context, making the monitoring less transparent and potentially privacy-invasive.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.