ClawHub
Back to skill

Security audit

Bug Bounty Pipeline

Security checks across malware telemetry and agentic risk

Overview

This skill is a real bug-bounty scanning workflow, but its automation can actively probe third-party systems with weak built-in scope and rate controls.

Install only if you intend to run authorized bug bounty or internal security testing and can manually enforce scope, consent, target allowlists, and low scan rates. Do not run the provided pipeline against arbitrary domains, public targets, or discovered secrets without explicit program permission and a clear data-handling process.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The skill claims rate limiting is mandatory, but the included commands use aggressive scanning settings such as full-port Nmap with high timing and do not enforce the documented 2-5 req/s cap. This creates a real risk of excessive traffic, accidental denial of service, and unauthorized high-volume probing if users run the scripts as written.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill promotes automated recon and scanning of targets without an upfront, prominent warning that execution causes network interaction with third-party systems and may affect privacy, logs, or service availability. In an agent context, that omission is dangerous because it lowers operator awareness and increases the chance of unintended or out-of-scope active probing.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The target-discovery section recommends GitHub dorking, historical URL mining, and other techniques that may surface exposed credentials or third-party personal data, but it does not give a clear handling warning. That omission can encourage unsafe collection, retention, or misuse of sensitive data during recon.

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Content
while IFS= read -r target; do
  [ -z "$target" ] && continue
  nmap --script vuln "$target" -oN "$OUTDIR/nmap-vuln-$target.txt" 2>/dev/null
done < "$TARGETS_FILE"

# OpenVAS (if installed)
echo "[3/4] OpenVAS scan..."
Confidence
97% confidence
Finding
nmap -s; nikto -h

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.