ClawHub
Back to skill

Security audit

Reading Widget Clawhub

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed WeRead desktop widget that uses a local helper, a WeRead API key, and optional startup persistence in ways that fit its stated purpose.

Install only if you are comfortable storing a WeRead API key in local agent settings and running a local helper on 127.0.0.1. Treat the optional LaunchAgent as a background startup service: enable it only if you want automatic refreshes, and remove the plist, widget directory, and API key from settings when uninstalling.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases include broad natural-language requests such as '让我也用上' and '装这个 widget', which can overlap with ordinary conversation and cause unintended invocation. Because this skill performs system changes, writes files, and may guide persistent background installation, accidental triggering increases risk beyond a harmless UI action.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill directs the agent to store a sensitive WEREAD_API_KEY into a persistent settings file without an explicit warning about the security implications of local credential storage. Even though it advises against shell rc files and plist storage, persisting the key in settings still creates credential-at-rest risk and should be accompanied by clear consent and storage guidance.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The template performs a background POST to a local service whenever the goal input changes, but the UI does not clearly disclose that editing the field triggers network communication to localhost. Hidden side effects are risky because any page script execution or injected DOM interaction could cause state changes in the local companion service without meaningful user awareness.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script loads an API key not only from its own config but also by probing user-level settings files under ~/.claw and ~/.claude, then uses that credential to make authenticated requests to a remote API. That creates a cross-context secret access issue: installing or running this skill can silently consume a credential the user may have intended for a different tool, without clear disclosure or consent at the point of use.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.