ClawHub
Back to skill

Security audit

Ticketmax

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward receipt-printer helper; its physical printing actions are visible and aligned with its purpose.

Install only if you intend agents to send content to a real configured printer. Confirm PRINTER_ADDR before use, review sensitive text before printing, and prefer a pinned or reviewed ticketmax version if supply-chain reproducibility matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
87% confidence
Finding
This markdown file describes direct printing to a thermal receipt printer and later documents control features like paper cutting and buzzer activation, but it does not explicitly warn users that invoking the skill will trigger physical device actions. Because the skill can consume stdin or files and send output to a real printer, a brief disclosure would help prevent unintended prints or device actions.

Hidden Instructions

High
Category
Prompt Injection
Content
| `\| A \| B \| C \|` | Three columns |
| `![alt](path)` | Image (PNG, JPEG, GIF) |
| `` ```qr `` | QR code block |
| `<!-- cut -->` | Cut paper |
| `<!-- beep -->` | Buzzer (1 beep) |
| `<!-- beep N -->` | Buzzer (N beeps) |
Confidence
70% confidence
Finding
<!-- cut -->` | Cut paper | | `<!-- beep -->` | Buzzer (1 beep) | | `<!-- beep N -->` | Buzzer (N beeps) | ### Example ```markdown # Morning Report ## Sales | Item | Revenue | | --- | --- | | Widg

Hidden Instructions

High
Category
Prompt Injection
Content
| `\| A \| B \| C \|` | Three columns |
| `![alt](path)` | Print image (PNG, JPEG, GIF) |
| `` ```qr `` | QR code block |
| `<!-- cut -->` | Cut paper |
| `<!-- beep -->` | Buzzer (1 beep) |
| `<!-- beep N -->` | Buzzer (N beeps) |
Confidence
70% confidence
Finding
<!-- cut -->` | Cut paper | | `<!-- beep -->` | Buzzer (1 beep) | | `<!-- beep N -->` | Buzzer (N beeps) | ## Example To print a report, write markdown to a temp file and pipe it to ticketmax: ```b

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.