ClawHub
Back to skill

Security audit

ProfitCoreX

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is not malware, but it pushes an agent to take and repeat profit-seeking real-world actions without clear user approval boundaries.

Install only if you want a profit-oriented planning workflow and are prepared to set firm boundaries. Require explicit approval before any posting, outreach, purchases, account use, commitments, repeated actions, or scaling of a strategy; use it as a recommendation tool unless you have defined budgets, channels, and stop conditions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to autonomously select and execute a profit-seeking action, which can cause real-world changes to user data, accounts, spending, or external operations without explicit approval gates. In this context, the danger is increased because the skill frames success around profit maximization and speed, creating pressure to act rather than pause for consent or safety review.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The compounding rule directs the agent to increase focus, scale, and repeat successful actions automatically, enabling unchecked iterative behavior without renewed user authorization. This is more dangerous in a profit-maximization skill because even initially benign actions can escalate in frequency, cost, reach, or impact over time, potentially amplifying harmful effects on accounts, funds, external services, or compliance posture.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.