ClawHub
Back to skill

Security audit

Google Sheets Fdds Report

Security checks across malware telemetry and agentic risk

Overview

This skill reads a user-specified Google Sheet to generate a logistics report, with optional user-requested write-back, and shows no hidden execution or persistence.

Install only if you are comfortable letting the agent access the specified Google Sheet and its FDDS/logistics data. Ask the agent to confirm the spreadsheet, tabs, and any destination range before writing the generated report back.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill explicitly allows writing generated output back into the Google Sheet, but it does not require an explicit confirmation step or warn the user that document contents may be modified. In an agent setting, this can lead to unintended overwrites, corruption of templates, or propagation of incorrect analysis into a shared operational document.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The skill instructs the agent to access a user-specified Google Sheet via the Google Sheets API without warning that the document may contain sensitive business or logistics data. While this is consistent with the skill's purpose, the absence of privacy and scope guidance increases the risk of over-broad access or exposing data from an unintended spreadsheet.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.