ClawHub
Back to skill

Security audit

Pizzaparty Automation

Security checks across malware telemetry and agentic risk

Overview

This skill can post automated Twitch chat using user credentials, but its credential needs and controls are broader and less clear than its stated PizzaParty purpose supports.

Review carefully before installing or running. Use only a limited, revocable Twitch token, avoid providing Discord passwords or Twitch client secrets unless you independently verify why they are needed, and confirm the exact channels, message volume, and platform-policy risks before enabling automated chat.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation instructs users to supply multiple highly sensitive credentials, including email/password and Twitch client secrets, for an automation workflow that performs account actions and chat activity. Without prominent warnings about account compromise, platform ToS violations, credential storage, and privacy exposure, users may unknowingly hand over secrets to a skill that can impersonate them across external services.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code establishes a network connection to Twitch IRC and sends chat messages without any user-facing consent, warning, or runtime confirmation. In the context of an automation skill explicitly intended for repeated engagement sessions, this increases the risk of stealthy or non-consensual outbound actions, account misuse, spam, and violation of platform rules.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill requires a Twitch OAuth token and uses it directly for authenticated IRC access, but provides no warning about sensitive credential handling, storage expectations, or exposure risks. Users may pass long-lived secrets on the command line, which can leak through shell history, process listings, logs, or orchestration systems.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.