ClawHub
Back to skill

Security audit

Cheat Code Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent external knowledge lookup tool, but it is too broadly triggered and under-discloses that user query content may be sent to a token-backed external service.

Review before installing. Use it only when you intentionally want external lookup, configure only a trusted endpoint, avoid sending secrets or personal data in queries, and do not echo access tokens in shared terminals or logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger condition is extremely broad ('use when AI model calling, intelligent dialogue, agent orchestration, LLM applications are needed'), which can cause the skill to activate across many ordinary conversations. In this skill's context, activation leads to external network requests and token-backed knowledge queries, so over-triggering can cause unintended data egress, unnecessary credential use, and surprising behavior for users.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The large keyword-based 'coverage scope' makes the skill applicable to many loosely related scenarios without precise boundaries. In a tool that can call an external service using an access token, this ambiguity increases the chance of unintended invocation and accidental sending of prompts or sensitive context to the remote endpoint.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill instructs the agent to send requests to an external knowledge service and to use an access token, but it does not clearly warn users that prompt contents may be transmitted off-platform or that secrets and personal data should not be included. Because the skill is designed around external retrieval, this omission materially raises the risk of sensitive data leakage and unsafe credential handling.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.