ClawHub
Back to skill

Security audit

yoooclaw-hotspot-topic-scout-en

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-aligned, but it reads sensitive phone notifications and message-derived content with insufficient user control and scoping.

Before installing, users should only enable this skill for accounts and groups they are comfortable having analyzed for content planning. Avoid connecting private, personal, confidential team, or customer-message sources unless the people involved have consented and the monitored time range and apps are tightly scoped.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation description is broad enough to trigger on many generic requests about trends, topics, or recent content, increasing the chance the skill runs when the user did not intend to invoke a workflow that inspects sensitive notifications. In this skill’s context, overbroad activation is more dangerous because the downstream behavior includes collecting internal phone notifications and group/private-message derived signals.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill explicitly directs collection of mobile notifications, group chats, team discussions, and fan feedback, which may contain sensitive personal, confidential, or third-party data, but it does not present a clear user-facing privacy notice or consent gate at the point of use. This is especially risky here because the skill combines internal data with web results, potentially broadening exposure and enabling unintended processing of private communications beyond user expectations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.