ClawHub
Back to skill

Security audit

Docs Pipeline Automation

Security checks across malware telemetry and agentic risk

Overview

This skill is a local Docs-pipeline specification generator with some overstated wording, but no evidence of hidden access, credential use, network activity, persistence, or exfiltration.

Reasonable to install for generating local pipeline specification artifacts. Treat it as a planner/export helper, not a working Google Docs/Drive/Sheets automation. Use project-local input and output paths, and avoid relying on --dry-run to prevent writes because the current script still creates or overwrites the output file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill advertises integration with Sheets, Drive, Docs, template assembly, and scheduled publishing, but the described behavior appears limited to generating a local pipeline description and emitting Markdown/CSV artifacts. This mismatch is dangerous because users may authorize, trust, or operationalize the skill under false assumptions, which can enable misuse, bypass review expectations, and conceal the true data flows and outputs.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.