ClawHub
Back to skill

Security audit

lululemon-research

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a Lululemon research helper, but its bundled API script can be used as a broad Crawlora client outside the stated Lululemon scope.

Review before installing. Use only if you are comfortable giving this skill a Crawlora API key and ensuring the agent calls only the documented /lululemon endpoints; a safer version would hardcode or allowlist the five Lululemon routes and remove the generic examples and base URL override.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The helper is documented and structured as a generic Crawlora client with examples for unrelated endpoints such as Amazon, YouTube, Google Search, and Google Trends, which exceeds the manifest’s narrowly stated Lululemon-only research purpose. In an agent skill context, this creates a scope-expansion vulnerability: prompts or downstream code can invoke arbitrary third-party retrieval capabilities using the provided API key, enabling unauthorized data access paths beyond the declared trust boundary.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The script forwards a caller-controlled path, method, query string, and POST body directly to the Crawlora API, effectively exposing broad third-party content retrieval rather than a constrained Lululemon research tool. Because there is no endpoint restriction or request-shape validation, an agent or prompt injection could repurpose this skill to query unrelated sites and services with the operator’s API key, violating least privilege and the manifest’s stated intent.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The inline documentation explicitly advertises broad, multi-site usage patterns that contradict the skill’s Lululemon-specific description, signaling that the implementation is intended for general-purpose web retrieval rather than the claimed narrow capability. In security-sensitive agent ecosystems, this mismatch increases misuse risk because operators and orchestration layers may trust the manifest while the code exposes materially broader behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:27