ClawHub
Back to skill

Security audit

Social Note Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple social-content generator that sends the user's topic and style request to a disclosed external API, with no hidden installation, persistence, or automatic posting behavior.

Before installing, users should understand that topics, style requests, and any included business or campaign details will be sent to wsdsocial.com's API. Avoid submitting secrets, private customer data, or confidential launch plans unless that external service is approved for that information.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill sends user-provided topic and request content to a third-party API, but the description does not clearly disclose that external transmission will occur. This can lead users to unknowingly share sensitive business, personal, or campaign information with an outside service, creating confidentiality and privacy risk.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.