ClawHub
Back to skill

Security audit

Decomposes complex user requests into executable subtasks, identifies required capabilities, searches for existing skills at skills.sh, and creates new skills when no solution exists. This skill should be used when the user submits a complex multi-step request, wants to automate workflows, or needs help breaking down large tasks into manageable pieces.

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed skill-management helper, but users should review any third-party skills it installs or creates.

Install only if you want an agent helper that can discover, install, and scaffold other skills. Before approving any install or creation step, check the skill source, read its SKILL.md, and avoid processing private documents through third-party services unless you understand where the data goes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README promotes installing and generating skills that can change a system or introduce executable code, but it does not warn users that adding third-party skills may execute untrusted logic or modify their environment. In a skill whose purpose is to discover and create more skills, this omission is more dangerous because it normalizes automated expansion of the agent's capabilities without clear trust or review boundaries.

Missing User Warnings

Low
Confidence
79% confidence
Finding
The examples encourage downloading external files and sending extracted or summarized content to third-party services without mentioning privacy, consent, retention, or handling of sensitive data. While the examples are illustrative, they could lead users to process confidential documents or transmit data externally without appropriate safeguards.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description is triggered by very broad conditions such as any 'complex multi-step request' or general help with automation, which can cause over-invocation in ordinary conversations. In practice, that increases the chance the agent will enter a workflow that searches for, installs, or creates external skills and proposes execution plans in contexts where the user only wanted advice, expanding attack surface and enabling unnecessary access to external tooling.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.