ClawHub
Back to skill

Security audit

EliteEntrepreneurOS — $100/Day AI Startup Engine

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a business-planning helper, but it asks the agent to execute or delegate broad business and marketing actions without clear approval boundaries.

Review carefully before installing. It appears non-destructive as packaged and the scripts are simple, but use it only with explicit confirmation before any tool is allowed to send messages, publish content, spend money, deploy code, or act on business accounts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation phrases are broad enough to match ordinary business-planning requests such as asking what to do this week to make money, which increases the chance of unintended invocation. Because the skill is designed to generate plans and drive execution, accidental activation could trigger consequential business actions or override a user's expectation of a normal advisory response.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states it can execute or delegate tasks through other tools but does not warn the user that it may take autonomous actions beyond producing advice. In this context, the omission is more dangerous because the skill markets 'ruthless efficiency' and end-to-end execution, which can lead users to authorize impactful actions without understanding the scope, side effects, or required approvals.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.