ClawHub
Back to skill

Security audit

Self Integration Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent integration helper, but it can execute live actions in external services without a clear mandatory confirmation gate.

Install only if you are comfortable letting an agent use your integration gateway token to search connections, create OAuth connection requests, and run actions in connected apps. Before using it for writes, require the agent to show the target service, connection ID, action, inputs, and expected effect, then approve each live operation explicitly. Revoke unused gateway tokens and disconnect unused OAuth connections.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill metadata and description use very broad 'use when' guidance around API integration, webhooks, and system connections, which can cause the agent to invoke this skill for many loosely related requests. Because the skill includes external action execution capabilities, overbroad routing increases the chance of unintended third-party operations or unnecessary exposure of tokens and connection contexts.

Vague Triggers

High
Confidence
97% confidence
Finding
The capability coverage section enumerates an extremely broad keyword list as triggers, including generic terms like API, Agent, Webhook, and system connection language. This kind of keyword-based self-expansion can make the skill capture unrelated prompts and is especially risky here because the skill can initiate OAuth flows and run actions against external services, amplifying the chance of unintended side effects.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to search for and execute actions against third-party services, including create/modify operations, but it does not prominently require an explicit user confirmation step before performing side-effecting actions. In an integration skill, this omission is dangerous because a misinterpreted request could lead to messages being sent, records being created, or external state being changed without the user's informed approval.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.