ClawHub
Back to skill

Security audit

Analytics Dashboard

Security checks across malware telemetry and agentic risk

Overview

This is a coherent analytics dashboard skill, but users should be deliberate about exports, scheduled sharing, credentials, and live WebSocket data.

Install only if you want an agent to help build or operate an analytics dashboard. Before exporting, scheduling reports, configuring webhooks/OAuth/database access, or enabling WebSocket push, confirm the data source, recipients, output location, credentials, and network exposure.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The activation guidance is broad enough to trigger on common requests like data analysis, report generation, and visualization, which can cause the skill to engage in situations the user did not explicitly intend. In an agent setting with exec enabled, overbroad triggering increases the chance of unreviewed command execution, exports, or networked behaviors under a vague user request.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill describes report export and automatic distribution workflows but does not warn about side effects such as writing files, sending data externally, or distributing potentially sensitive analytics to recipients. Without explicit user-facing safeguards, an agent could generate and disseminate reports containing confidential operational data to unintended destinations.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documents WebSocket real-time push, including a tokenized endpoint, but provides no privacy, network exposure, or token-handling warnings. In practice, this can lead users or agents to expose live operational data over insecure or locally misconfigured channels, especially since the example uses plain ws:// instead of secure transport.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.