ClawHub
Back to skill

Security audit

GOG Stale Games Cleaner

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it scans a local GOG library file, emails a stale-game report, and creates reminders, with the main privacy risk clearly disclosed.

Run the documented dry run first, confirm the GOG library path, Himalaya account, and intended recipient before a full run, and be aware that the email may contain game names plus local install paths. Only enable the suggested cron schedule intentionally, since repeated runs may add more reminders.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script automatically emails a report containing the user's local game inventory, last-played dates, and install paths during normal execution, with no interactive confirmation or explicit disclosure at send time. Even though this matches the skill's stated purpose, it still transmits potentially sensitive local metadata off-host and could surprise users or leak information if EMAIL_TO or the selected account is misconfigured.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The script automatically creates reminders based on local game activity without a user-facing confirmation in normal execution. This is less severe than email exfiltration because it remains on the local reminders system, but it still modifies user data and can create unwanted tasks or clutter, especially if the list name or game metadata is unexpected.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.