ClawHub
Back to skill

Security audit

URL Summarizer

Security checks across malware telemetry and agentic risk

Overview

This URL summarizer is coherent and shows no hidden or destructive behavior, but users should only use it for URLs they intend the agent to access.

Install if you want a helper for summarizing public web pages. Review each URL before use, and avoid asking it to access localhost, private network, account-only, or otherwise sensitive pages unless you explicitly intend that access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
76% confidence
Finding
The description is broad enough that the skill may be invoked for generic summarization requests, causing the agent to fetch external URLs when the user did not clearly intend a network action. That can expand the skill's activation surface and lead to unintended remote requests or use in contexts outside its narrow URL-specific purpose.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to run a script against user-provided URLs but does not warn that this causes remote network fetches. Without a clear disclosure, users and integrators may not realize the skill can contact arbitrary hosts, which increases the risk of SSRF-like access attempts, internal network probing, or privacy-sensitive outbound requests depending on the runtime environment.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.