ClawHub
Back to skill

Security audit

home-inventory

Security checks across malware telemetry and agentic risk

Overview

This is a local home-inventory tool whose file creation and exports match its stated purpose, but users should treat the stored inventory and CSVs as sensitive.

Before installing, decide where inventory.json and exported CSVs should live, because they may reveal valuable possessions, locations, serial numbers, and other private household details. Store them somewhere protected, avoid unnecessary sharing, and review CSV contents before sending them to an insurer or third party.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill clearly describes commands that read from and write to a local JSON database and export files, yet it declares no permissions or equivalent capability disclosure. This is dangerous because users and hosting platforms may not realize the skill can persist sensitive household inventory data, leading to under-informed consent and weaker policy enforcement around file access.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README encourages exporting detailed household inventory data to CSV and uploading it to insurance providers, but it does not warn that the export may contain sensitive personal information such as high-value assets, room locations, serial numbers, and ownership details. In the context of a home inventory tool, this omission increases the risk of accidental over-disclosure, insecure sharing, or long-term storage of sensitive data outside the local system.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill stores a detailed household inventory locally, including serial numbers, item values, room locations, notes, and photo paths, but does not warn users that this creates a sensitive at-rest dataset. Such data could materially aid theft, stalking, fraud, or privacy compromise if the machine, backup, or exported files are accessed by unauthorized parties.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.