ClawHub
Back to skill

Security audit

subscription-slayer

Security checks across malware telemetry and agentic risk

Overview

This skill locally analyzes a user-provided subscription list and drafts cancellation email templates without hidden network access or persistence.

Before installing, be aware that your subscription JSON may contain financial and account-related information. Keep that file local, review any generated cancellation email yourself, verify the recipient address, and only send messages after confirming the account details are correct.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes a local script against a user-supplied JSON file (`subs.json`), which implies file-read capability even though no permissions are declared. Undeclared capabilities are dangerous because they weaken consent and review boundaries: an agent or user may not realize the skill accesses local files, and future implementations could broaden that access beyond the intended subscription file.

Missing User Warnings

Low
Confidence
80% confidence
Finding
The skill advertises generating or sending cancellation emails but does not warn about privacy, account-data handling, or the fact that sending such messages may trigger external actions on the user's behalf. This can lead users to disclose account identifiers or contact details without clear consent boundaries, and could cause unintended communications if an agent automates sending.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.