ClawHub
Back to skill

Security audit

here.now

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed publishing and private storage skill, but users should be careful because it can upload selected files, create public links, and persist account credentials.

Install only if you want an agent to publish selected local files to here.now or use here.now Drive storage. Before each publish, confirm whether the result should be public, password-protected, restricted, or private Drive-only. Treat ~/.herenow/credentials and .herenow/state.json as sensitive because they can preserve account access and claim tokens across sessions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill requires network and shell capabilities to publish content and manage storage, but it does not declare those capabilities or warn about their security implications. Undeclared execution and outbound network behavior reduce transparency for the agent/runtime and can lead to unsafe invocation in contexts where users do not expect file upload or command execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill is described primarily as a website/file publishing tool, but the body also exposes broad private Drive operations including reading, deleting, importing/exporting, and creating scoped sharing tokens. That mismatch can cause an agent or user to authorize the skill for simple publishing while unintentionally granting it powerful data-management capabilities with confidentiality and integrity impact.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases are very broad, covering generic requests like 'share this', 'deploy this', 'generate a URL', and 'build a chatbot'. In an agent ecosystem, such broad matching can invoke this skill in situations where the user did not intend public hosting or remote upload, increasing the risk of accidental disclosure of sensitive files or workspace content.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill promotes fast publishing to live URLs but does not prominently warn that the default mode is public link access and that sensitive files may become internet-accessible. In context, this skill directly handles user files and website content, so lack of an upfront warning materially increases the chance of accidental exposure.

External Transmission

Medium
Category
Data Exfiltration
Content
upload=$(api_json POST "$BASE_URL/api/v1/drives/$id/files/uploads" "$body")
  upload_url=$(echo "$upload" | "$JQ_BIN" -r '.uploadUrl')
  upload_id=$(echo "$upload" | "$JQ_BIN" -r '.uploadId')
  http_code=$(curl -sS -o /dev/null -w "%{http_code}" -X PUT "$upload_url" -H "Content-Type: $ct" --data-binary "@$local_file")
  [[ "$http_code" -ge 200 && "$http_code" -lt 300 ]] || die "upload failed for $path (HTTP $http_code)"
  api_json POST "$BASE_URL/api/v1/drives/$id/files/finalize" "$("$JQ_BIN" -n --arg u "$upload_id" '{uploadId:$u}')" | "$JQ_BIN" .
}
Confidence
86% confidence
Finding
curl -sS -o /dev/null -w "%{http_code}" -X PUT "$upload_url" -H "Content-Type: $ct" --data-binary

External Transmission

Medium
Category
Data Exfiltration
Content
# Step 3: Finalize
echo "finalizing..." >&2
FIN_RESPONSE=$(curl -sS -X POST "$FINALIZE_URL" \
  "${AUTH_ARGS[@]+"${AUTH_ARGS[@]}"}" \
  "${CLIENT_ARGS[@]+"${CLIENT_ARGS[@]}"}" \
  "${ACCOUNT_ARGS[@]+"${ACCOUNT_ARGS[@]}"}" \
Confidence
74% confidence
Finding
curl -sS -X POST "$FINALIZE_URL" \ "${AUTH_ARGS[@]+"${AUTH_ARGS[@]}"}" \ "${CLIENT_ARGS[@]+"${CLIENT_ARGS[@]}"}" \ "${ACCOUNT_ARGS[@]+"${ACCOUNT_ARGS[@]}"}" \ -H "content-type: application/jso

Session Persistence

Medium
Category
Rogue Agent
Content
Publish HTML, documents, images, PDFs, videos, and static files to live
  URLs at {slug}.here.now or custom domains. Use when asked to "publish
  this", "host this", "deploy this", "share this on the web", "make a
  website", "put this online", "create a webpage", "generate a URL",
  "build a chatbot", "password protect this site", "make this site
  private", or "share this site with only certain people". here.now also
  includes workspaces — shared team accounts where Sites belong to the
Confidence
71% confidence
Finding
create a webpage", "generate a URL", "build a chatbot", "password protect this site", "make this site private", or "share this site with only certain people". here.now also includes workspaces —

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.