ClawHub

Client Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward local freelancer CRM skill that saves client and invoice records on disk without signs of hidden networking, credential access, or destructive behavior.

Install only if you are comfortable storing CRM data in a local clients/clients.json file. Protect that folder, avoid entering unnecessary sensitive information, keep backups as appropriate, and confirm before letting the agent create or update client, invoice, budget, or notes records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The skill is activated by broad natural-language descriptions like "track clients, projects, and money through conversation" without clearly defining when it should engage or what actions require explicit confirmation. In an agent environment, this can cause overbroad triggering and unintended processing or storage of sensitive business and personal data from ordinary conversation.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill persists potentially sensitive CRM data such as client names, emails, notes, projects, and invoices to a local JSON file without any disclosure, consent flow, access controls, or data-protection safeguards. In the context of an agent skill that users may interact with conversationally, this creates a real privacy and security risk because users may reasonably assume transient processing while the skill silently stores business and personal data on disk.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal