ClawHub
Back to skill

Security audit

Sina Market (GSAgent)

Security checks across malware telemetry and agentic risk

Overview

The available evidence shows a low-risk skill with disclosed, purpose-aligned use of network or local reference access, and no concrete malicious behavior was identified.

Install if you are comfortable with the skill using network access and local supporting files for its stated workflow. Review the skill text for what sources it may contact and what files it may read, and avoid using it with sensitive local data unless those access boundaries are clear.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises and relies on network access and likely local file reads via scripts/references, but the manifest shown in SKILL.md does not declare permissions. Undeclared capabilities create a transparency and policy-enforcement gap: operators and users cannot accurately assess what the skill can access, and platforms that depend on declared permissions may fail open or review the skill incorrectly.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal