ClawHub
Back to skill

Security audit

Agent Orchestrator

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate multi-agent orchestration skill, but it gives spawned agents broad file, command, and third-party API capabilities without enough scoping or data-use safeguards.

Install only if you intentionally want autonomous multi-agent delegation. Use a dedicated workspace, review generated sub-agent instructions before dispatch, set explicit limits on tools, paths, runtime, and agent count, and do not provide SKILLBOSS_API_KEY or sensitive input data unless third-party processing by SkillBoss is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The mandatory trigger list includes broad phrases like 'orchestrate', 'delegate tasks', and 'task breakdown' that can match many ordinary requests, causing this skill to activate in contexts the user did not explicitly intend. Because the skill performs agent spawning, file creation, and coordination side effects, over-broad activation increases the chance of unexpected autonomous actions and expands the attack surface.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs creation of agent workspaces, dynamic SKILL.md generation, file copying, status tracking, and later cleanup/archive operations without any user-facing warning or consent mechanism. In an agentic environment, these are real side effects on the filesystem and can lead to unintended data duplication, overwrites, workspace contamination, or destruction of temporary artifacts.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill directs sub-agents to use an external API service with an environment-backed credential but provides no privacy or data-transmission warning. This creates a risk that task contents, user files, or sensitive intermediate outputs are sent off-platform to a third party without informed consent or data minimization.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The Research Agent template explicitly instructs sub-agents to send user queries and scraped content to an external API and to write files locally, but it provides no warning, consent step, or data-handling constraint. In an orchestrator context, this is risky because dynamically spawned agents may process sensitive instructions or documents and transmit them off-host without the operator realizing it.

Missing User Warnings

High
Confidence
98% confidence
Finding
The Analysis Agent template instructs the agent to embed `data` directly into a chat request to an external LLM API, creating a straightforward path for sensitive dataset exfiltration. Because this skill is a meta-agent that spawns autonomous sub-agents, the lack of disclosure and guardrails materially increases the chance that confidential or regulated data will be transmitted externally.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

   def pilot(body):
       r = requests.post(
           "https://api.heybossai.com/v1/pilot",
           headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
           json=body, timeout=60,
Confidence
88% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

     def pilot(body):
         r = requests.post(
             "https://api.heybossai.com/v1/pilot",
             headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
             json=body, timeout=60,
Confidence
95% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

   def pilot(body):
       r = requests.post(
           "https://api.heybossai.com/v1/pilot",
           headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
           json=body, timeout=60,
Confidence
88% confidence
Finding
requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

     def pilot(body):
         r = requests.post(
             "https://api.heybossai.com/v1/pilot",
             headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
             json=body, timeout=60,
Confidence
95% confidence
Finding
requests.post( "https://api.heybossai.com/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=

External Transmission

Medium
Category
Data Exfiltration
Content
def pilot(body):
       r = requests.post(
           "https://api.heybossai.com/v1/pilot",
           headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
           json=body, timeout=60,
       )
Confidence
87% confidence
Finding
https://api.heybossai.com/

External Transmission

Medium
Category
Data Exfiltration
Content
def pilot(body):
         r = requests.post(
             "https://api.heybossai.com/v1/pilot",
             headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
             json=body, timeout=60,
         )
Confidence
93% confidence
Finding
https://api.heybossai.com/

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.