ClawHub
Back to skill

Security audit

Council

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed multi-persona analysis tool, but users should understand that its installed agents can use local file, shell, and web tools when the host permits them.

Install only if you want persistent Claude Code council agents and are comfortable with those agents having broad file, shell, and web capabilities when your host allows them. Review any requested Bash or web actions before approval, and avoid putting secrets in /council prompts because the prompt content may be shared across several subagents.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
WebSearch and WebFetch are broader than necessary for a historical-thinker deliberation persona whose documented role is conceptual analysis rather than external research. While less dangerous than Bash, unnecessary network-capable tools can still enable data exfiltration, retrieval of attacker-controlled content, or prompt-injection through untrusted web material.

Context-Inappropriate Capability

Low
Confidence
82% confidence
Finding
WebSearch and WebFetch are broader than necessary for a historical-thinker deliberation persona whose documented role is conceptual analysis rather than external research. While less dangerous than Bash, unnecessary network-capable tools can still enable data exfiltration, retrieval of attacker-controlled content, or prompt-injection through untrusted web material.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.