ClawHub
Back to skill

Security audit

Tahcia Console

Security checks across malware telemetry and agentic risk

Overview

This skill is a real-browser and macOS automation helper, but it asks for broad desktop control, local credential use, external screenshot analysis, and persistent self-editing.

Install only if you are comfortable granting a helper broad control over Chrome and macOS, and do not allow it to read local API key files, send screenshots to third-party vision services, edit its own SKILL.md, schedule scripts, or overwrite files unless you explicitly intend those actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill explicitly instructs the agent to read a local API key from ~/.gemini/api_key.txt and use curl to send screenshots to an external model provider. This creates both secret-access and data-exfiltration risk because the agent is encouraged to consume a local credential unrelated to the current task and transmit potentially sensitive visual data off-device.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill tells the agent to write learned information back into SKILL.md, which authorizes local file modification without explicit user approval or scope limits. This creates an integrity risk because the agent may persist altered instructions, poison future runs, or overwrite user-maintained content.

Missing User Warnings

High
Confidence
99% confidence
Finding
The skill exposes a local API key file path and instructs sending screenshot data to an external vision service without a meaningful privacy warning or consent step. In context, the screenshots may contain browser, desktop, or application content, so the guidance materially increases the chance of unauthorized disclosure.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The instructions automate saving screenshots to disk and explicitly recommend confirming replacement of existing files. That can overwrite user data or persist sensitive captures locally without warning, especially in a real desktop-control environment.

Ssd 3

High
Confidence
99% confidence
Finding
Directing the agent to use a locally stored API key file for outbound requests is a clear secret-handling violation. It normalizes unauthorized secret access and enables data transfer to a third party using credentials the user may not have intended this skill to consume.

Self-Modification

High
Category
Rogue Agent
Content
/mac.key.type filename-and-its.extension
sleep 2
/mac.key.enter
another /mac.key.enter * to make sure it replace existing file

### Open a new tab:
/tab [full url]
Confidence
89% confidence
Finding
replace existing file

Session Persistence

Medium
Category
Rogue Agent
Content
LOOP: ANALYZE (screenshot + OCR + elements) → DECIDE ONE ACTION → EXECUTE → REVIEW result → DONE or repeat.

Every iteration: save your goal, current mini-goal, execution theory, and what you learn about using macOS.
When you learn something (like coordinate systems, timing, app behavior), write it back to this SKILL.md so future-you benefits.

A loop iteration ends with either:
- **DONE** (goal complete) — return control.
Confidence
95% confidence
Finding
write it back to this SKILL.md so future-you benefits. A loop iteration ends with either: - **DONE** (goal complete) — return control. - **REVERT** (mistake made) — undo, learn, retry. - **GIVE UP**

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.