ClawHub
Back to skill

Security audit

yoooclaw-hotspot-topic-scout

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for scouting content topics, but it reads broad phone notification and group-chat content and can mix those private signals with web searches without enough scoping or privacy controls.

Review this before installing if your notifications include private, client, workplace, or confidential chats. Use it only with clearly selected apps/groups and avoid letting it analyze all notifications unless you are comfortable with those private signals being summarized and used to guide web searches.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs collection and analysis of phone notifications, group chats, team discussions, and fan feedback, which are likely to contain sensitive personal or business information. Because the skill text lacks a clear user-facing privacy warning, consent checkpoint, minimization guidance, or restrictions on sensitive sources, it creates a real privacy and data-handling risk rather than a purely theoretical issue.

Missing User Warnings

Low
Confidence
92% confidence
Finding
The skill combines internal notification-derived context with external web and RSS searches to enrich profiling of topics, competitors, and fan demand, but it does not warn the user that private device-derived signals may be merged with network-fetched data. This cross-source aggregation increases privacy sensitivity because private context can influence external queries and broaden exposure of inferred interests, relationships, or confidential business focus areas.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.