ClawHub
Back to skill

Security audit

目的地安全指数

Security checks across malware telemetry and agentic risk

Overview

The skill appears non-malicious, but its travel-safety claims may overstate live or authoritative risk coverage in a way users could rely on incorrectly.

Review this skill carefully before using it for travel or personal safety decisions. Treat its output as a static planning aid unless the publisher documents current official sources, update frequency, coverage limits, and clear disclaimers; verify any safety-critical advice against official travel advisories before acting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill advertises real-time risk alerts, authoritative-source grounding, and broad destination coverage, but the file only describes a local, hardcoded dataset with no live retrieval or source verification. In a travel safety context, users may rely on stale or incomplete safety guidance for decisions involving personal security, which creates a meaningful trust and safety risk even without code execution.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.