ClawHub
Back to skill

Security audit

Caspian

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its messaging-integration purpose, but it asks agents to manage billing autopay and handle powerful messaging credentials with limited safety framing.

Review before installing. This skill can connect real messaging accounts, read incoming messages, send replies, and in some channels initiate outbound messages. Use least-privilege or test credentials, avoid sharing production tokens in chat, confirm every account connection and outbound capability, and do not let the agent configure billing autopay or spend limits unless you explicitly intend that recurring payment behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill instructs an agent to configure autopay and spending caps via API, extending its authority from messaging setup into financial-account management. That is dangerous because an over-permissioned or prompt-influenced agent could alter billing behavior or enable recurring charges without sufficiently explicit user approval.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill explicitly enables cold-start outbound messaging on SMS and iMessage, which goes beyond a passive inbound-response integration. That increases abuse potential because an agent intended only to reply to incoming messages could instead initiate unsolicited contact, causing spam, harassment, or policy violations.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The skill routes messages, credentials, and account-linking actions through external services but does not prominently warn about privacy, third-party data handling, or credential sensitivity up front. In this context that omission matters because users may provide API keys, bot tokens, phone-provider credentials, or message content without understanding the transmission and trust implications.

Credential Access

High
Category
Privilege Escalation
Content
### b) Branded - bring your own account tokens

Ask the developer for their app's Access Token, Access Token Secret, and numeric
user id (from developer.x.com, Keys & Tokens tab; App permissions "Read and write
and Direct message"). The user id is the part before the dash in the access token.
Confidence
87% confidence
Finding
Access Token

Credential Access

High
Category
Privilege Escalation
Content
### b) Branded - bring your own account tokens

Ask the developer for their app's Access Token, Access Token Secret, and numeric
user id (from developer.x.com, Keys & Tokens tab; App permissions "Read and write
and Direct message"). The user id is the part before the dash in the access token.
Confidence
87% confidence
Finding
Access Token

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:511