ClawHub

Discord Shopping Deals

Security checks across malware telemetry and agentic risk

Overview

This instruction-only Discord shopping helper is purpose-aligned and has no evidence of hidden code, credential access, persistence, or destructive behavior.

Install this only in Discord spaces where automated deal suggestions are welcome. For group chats, prefer explicit invocation such as a bot mention or command to avoid accidental searches, and verify seller reputation, price, shipping, condition, and coupons before buying.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill declares activation on very common shopping phrases like "shop," "find me a deal," and "best price for [product]," which are likely to appear in ordinary Discord conversations outside a user's intent to invoke a tool. This can cause unintended activation and unsolicited web lookups in group chats, increasing the chance of noisy behavior, privacy leakage from contextual parsing, or inappropriate tool use.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger section uses ambiguous keyword-based activation such as "shop, deal, buy, price check, cheapest, best [product]" without strong boundaries or exclusions, which is especially risky in Discord's informal conversational context. Because the skill also instructs parsing the product from context/query, it may fire on incidental mentions and act on group-chat content that was not meant as a request, leading to unauthorized or intrusive searches.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal