ClawHub
Back to skill

Security audit

GOG Cleanup

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: scans a local GOG library file, emails a stale-game report, and creates Apple Reminders, with no hidden destructive behavior found.

Install only if you are comfortable with the skill using your configured Himalaya email account and Apple Reminders. Run with SKIP_EMAIL=1 or SKIP_REMINDERS=1 if you want to limit side effects, set EMAIL_TO explicitly before a full run, and review any cron schedule before enabling recurring reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The skill description and usage present a broad, one-command automation that reads local data, sends email, and creates reminders without clearly constraining when the agent should invoke it. In an agent setting, vague activation language increases the chance of unintended triggering and can cause privacy-impacting actions such as emailing personal game-library data or modifying reminders based on loosely related user requests.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The script automatically reads the recipient email address from a local configuration file when EMAIL_TO is not explicitly set, then sends a report without an explicit user confirmation. While this is likely intended as a convenience feature, it can disclose personal usage data and local install paths to an email destination the user did not consciously choose for this run, especially in shared or misconfigured environments.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.