ClawHub
Back to skill

Security audit

Social Media Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent social-network API helper, but users should be aware it can send profile details, messages, swipes, and tokens to an external service.

Install only if you intend to let an agent interact with the configured social API. Set SOCIAL_API_BASE only to a service you trust, keep SOCIAL_TOKEN private, and require confirmation before registration, swipes, relationship changes, or sending chat messages.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill declares an extremely broad trigger surface using many generic keywords, which can cause the agent to invoke this skill for loosely related requests. In a skill with exec and network-facing behavior, overbroad activation increases the chance of unintended API calls, profile creation, message sending, or data disclosure without clear user intent.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The document advertises export/save/convert operations and the skill is allowed to use exec, but it does not clearly warn that these actions may write files locally or execute shell commands. This can mislead users or upstream agents into performing system-affecting operations without informed consent, especially in automated environments.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill includes multiple examples that transmit profile details, personality attributes, interests, emails, tokens, and chat messages to an external social platform, but it omits explicit privacy and data-transfer warnings. Because the content involves personal or sensitive behavioral data and outbound network requests, users may unknowingly expose private information to third-party services.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.