ClawHub
Back to skill

Security audit

discover-patent-white-space-opportunities

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent patent-analysis workflow that clearly guides staged user confirmations and only creates a session report as part of its stated reporting function.

Before installing, be aware that the skill may use an authorized PatSnap/Zhihuiya MCP connection for patent data and will create an HTML report in the session reports directory after completing the analysis. Avoid including confidential business material unless you are comfortable with it appearing in that generated report.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill mandates automatic generation and saving of an HTML report file to a session path without first obtaining explicit user consent for file creation. Automatic write operations can have privacy, data handling, and workspace integrity implications, especially in agent environments where users may not expect persistent artifacts to be created.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly instructs the agent to generate and save a self-contained HTML file automatically, but it does not provide a clear user-facing warning or require consent before modifying the workspace. In agent systems, silent file creation is a meaningful safety issue because it can surprise users, persist sensitive analysis, or clutter controlled directories.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.