ClawHub
Back to skill

Security audit

story-short-scan

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed web-scraping/reporting tool, but its BlackRock workflow uses a logged-in admin browser session and extracts an admin cookie as a Bearer token to call management APIs.

Install only if you intentionally want the agent to use a logged-in BlackRock admin browser session to read management-console data. Prefer a dedicated low-privilege account and separate browser profile, review the scripts before running them, and avoid using this skill with accounts that can modify business data or expose sensitive inventory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill instructs the agent to use networked data collection tools such as browser-cdp and WebFetch, and to access authenticated browser sessions to extract data from target platforms. Because the skill declares no permissions while clearly requiring network and environment/browser-state capabilities, it creates a capability mismatch that can bypass user or platform expectations and increases the risk of unintended data access, especially where login cookies or bearer tokens are involved.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script’s stated purpose is public-facing trend scanning, but it explicitly requires a manual login to an admin console, extracts the Admin-Token cookie, and uses it as a Bearer token against a backend management API. That is a scope mismatch: it accesses privileged internal data and credentials unrelated to the advertised user task, which can expose non-public inventory and normalize credential harvesting behavior inside an agent skill.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
Using authenticated admin credentials is unjustified for a short-story popularity scanning workflow, especially when the skill description suggests broad platform trend analysis rather than privileged management access. In skill context this is more dangerous, not less, because the mismatch can mislead operators into granting elevated access for a seemingly low-risk content analysis task.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/cdp-utils.js:88