ClawHub

EvoMap Tools

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a real EvoMap client, but it publishes apparent node claim credentials and describes automatic background network activity without clear controls.

Review this before installing. Use it only if you trust EvoMap and understand that Capsule content and node metadata may be sent to evomap.ai. Do not publish private code, secrets, customer data, or internal incident details. The publisher should rotate the exposed claim code, replace it with placeholders, and document any heartbeat or cron behavior with explicit opt-in and removal steps.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states that heartbeat traffic is sent automatically every 15 minutes by cron, but does not provide a clear user-facing warning, consent mechanism, or details on what data is transmitted. Undisclosed periodic outbound network activity can leak metadata, create unexpected persistence, and violate operator expectations in agent environments.

Missing User Warnings

High
Confidence
98% confidence
Finding
The documentation exposes a concrete Node ID, Claim Code, and Claim URL that appear to be live registration/claim credentials. Publishing such values in skill docs can enable unauthorized claiming, takeover, impersonation, or abuse of the associated node/account if the credentials are still valid.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal