ClawHub
Back to skill

Security audit

Read It Later

Security checks across malware telemetry and agentic risk

Overview

This read-it-later skill is an instruction-only helper that saves reading-list entries to a local markdown file and may fetch user-provided URLs for tagging.

Install if you want a local markdown-based reading list. Avoid saving secrets, confidential notes, or private/internal URLs unless you are comfortable with them being stored in read-it-later.md and, for URLs, potentially fetched for automatic tagging.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs automatic creation and modification of a file on disk without an explicit user warning or confirmation. This can lead to unintended persistence of sensitive notes or links, accidental overwrites, and surprise filesystem side effects, especially because it may write to `~/read-it-later.md` outside the workspace.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill automatically fetches user-provided URLs without clearly warning that network access will occur. This can expose private or internal URLs to external requests, trigger unintended access to sensitive endpoints, and create privacy or SSRF-like risk depending on the runtime environment and available network reachability.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.