ClawHub
Back to skill

Security audit

California LLC Formation

Security checks across malware telemetry and agentic risk

Overview

The skill is advertised as California LLC guidance, but its executable answers with Wyoming LLC guidance, which could mislead users making state-specific business decisions.

Review before installing or using this for business formation decisions. It does not appear to harm the system or access private data, but the bundled executable may give Wyoming-specific advice under a California skill name; verify fees, deadlines, tax obligations, and registered agent requirements with official California sources or a qualified professional.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The file is named as if it provides California LLC assistance, but the implementation and output are entirely Wyoming-focused. In an agent or skill-routing context, this mismatch can mislead users into taking the wrong legal or business formation actions, creating integrity and trust problems even though it is not code-execution risky.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The script embeds direct marketing links and contact details in what appears to be an informational assistant without clearly disclosing that it is promotional content. In a skill ecosystem, this can manipulate users, blur the boundary between neutral advice and solicitation, and increase the risk of deceptive lead generation.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The documentation and natural-language behavior consistently steer the user toward Wyoming guidance despite the file path indicating a California-oriented skill. This contextual deception makes the issue more dangerous because users may rely on the skill for state-specific compliance decisions and receive materially incorrect jurisdictional advice.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.