ClawHub
Back to skill

Security audit

Trein extended

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Dutch train-travel helper that uses the trein CLI and an NS API key for its expected purpose.

Before installing, confirm you trust the upstream trein npm package or GitHub release, prefer using NS_API_KEY from your environment when practical, and protect any local config or aliases because they may reveal your API key or usual travel locations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
86% confidence
Finding
The skill explicitly recommends storing the NS API key in a plaintext local config file under the user's home directory without any guidance on file permissions, secret handling, or preferring environment variables. While this is a common convenience pattern for CLIs, it can expose the credential to other local users, backups, accidental commits, or tooling that reads dotfiles/config directories.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.