ClawHub
Back to skill

Security audit

旅行购物退税计算器

Security checks across malware telemetry and agentic risk

Overview

This is a local Chinese-language travel tax-refund calculator with no evidence of hidden data collection, network access, persistence, or unsafe system behavior.

Install this if you want a Chinese-language, offline travel shopping tax-refund estimator. Treat the results as estimates only because tax rules and exchange rates can change and the skill uses embedded static data rather than live official sources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
This code file contains user-facing natural-language descriptions that assume Chinese as the only interaction language. The policy requires flagging language or locale constraints when a skill forces a specific language without user opt-in, and there is no indication here that users can choose another language.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The CLI help and error messages presented to users are exclusively in Chinese, and the rest of the returned output in the file follows the same pattern. Because the file does not offer a language choice or justify a China-specific audience, this is a natural-language policy violation under the locale/language rule.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.