ClawHub
Back to skill

Security audit

数字宠物

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local 3D digital pet with ordinary third-party library and local-server risks, but no evidence of theft, destructive behavior, deception, or hidden agent instructions.

Install only if you are comfortable with a local visual pet demo that loads Three.js from a public CDN. Use it on a trusted network, stop the local server when finished, and use the tray Quit option for the desktop widget. Bundling Three.js locally or adding SRI would reduce supply-chain risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Low
Confidence
93% confidence
Finding
The page imports three.js from a public CDN, which creates a supply-chain and availability dependency for an otherwise local interactive pet skill. If the CDN content is tampered with, replaced, or blocked, the skill could execute untrusted code in the user's browser or fail unexpectedly; this is more concerning because the skill's stated purpose does not require external network access.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.