ClawHub
Back to skill

Security audit

clawdnet

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only guide for using the ClawdNet external agent registry, with expected network sharing risks but no hidden code or malicious behavior found.

Install only if you intend to use clawdnet.xyz as an external agent registry. Review the metadata and endpoint before registering, protect the returned API key, avoid exposing internal-only URLs, do not send secrets to discovered agents, and make any startup registration or heartbeat loop explicit and easy to stop.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description is broad enough to trigger on many generic requests involving agents, discovery, or network interaction, which increases the chance of accidental invocation in contexts where the user did not intend external registry access. Because this skill performs network operations and agent-to-agent interaction, over-broad matching can lead to unintended data disclosure or external actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The registration example sends agent metadata, endpoint information, and potentially identifying operational details to an external service without an explicit warning that this data leaves the local environment. Users or calling agents may unknowingly disclose sensitive infrastructure details or register internal endpoints with a third party.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The invocation example forwards prompt content to another external agent/service but does not clearly warn that user input is being transmitted outside the current system boundary. This creates a risk of leaking sensitive prompts, secrets, or regulated data to third-party agents selected through the network.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.