ClawHub
Back to skill

Security audit

Lobster Compact

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only conversation compaction helper that clearly aims to summarize long chats and store context, but users should understand it may persist conversation details.

Install only if you are comfortable with long-chat summaries and selected context being saved to local memory files. Avoid using it on chats containing secrets, credentials, private keys, regulated personal data, or confidential project details unless your agent redacts those details or you explicitly want them retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger conditions are broad enough that the skill could activate on common phrases like 'summarize so far' without clearly signaling that it will also write to persistent memory. That increases the chance of unintended execution and silent retention of conversation content, especially near context limits where users may only expect ephemeral summarization.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to write summary content and logs to persistent files but provides no user-facing warning, consent step, or data minimization guidance. Users asking for a summary may unknowingly cause sensitive conversation details to be retained beyond the current session.

Ssd 3

Medium
Confidence
98% confidence
Finding
The skill explicitly tells the agent to persist detailed conversation history, technical details, user feedback, and current work into memory and log files in plain language. This creates a substantial privacy and data-handling risk because sensitive project information, credentials, personal data, or confidential context may be stored long-term without minimization, encryption, or user approval.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.