ClawHub
Back to skill

Security audit

AI Marketing Automation

Security checks across malware telemetry and agentic risk

Overview

This skill is framed as marketing automation, but it can affect live paid ad accounts and budgets without clear safety limits or approval steps.

Review this carefully before installing. Only use it with test or narrowly scoped ad accounts, hard spend limits, explicit approval before campaign creation or budget changes, and a clear way to stop or roll back live campaigns.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly advertises automatic ad placement, budget adjustment, and audience targeting across external platforms, but it does not warn users that these actions can spend real money or affect live third-party advertising accounts. In an agent context, this omission is risky because a user may treat the skill as informational automation rather than authorization to trigger costly external operations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The quick-start commands include creating campaigns and monitoring dashboards without any notice that the create-campaign flow may launch live marketing activity on connected platforms. This is dangerous because users may copy-paste startup commands assuming they are safe setup steps, when they may instead create external resources or initiate billable actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.