ClawHub
Back to skill

Security audit

Blackbox

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Blackbox CLI helper with expected coding-agent risks, but no hidden, deceptive, or purpose-mismatched behavior was found.

Install only if you trust the Blackbox CLI and are comfortable sending relevant project context to external AI services. Use a scoped project directory, keep version control enabled, review diffs after runs, avoid `--yolo` on important repositories, monitor background sessions and credit usage, and do not place secrets in prompts or files exposed to the agent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly documents a `--yolo` mode that auto-approves all actions and model switches, but it does not pair this with any warning about unattended execution, destructive edits, or the need for explicit user consent. In a coding-agent context, this increases the chance of unintended file changes, dependency installation, or risky command execution being performed without review.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The skill instructs the user to configure the Blackbox CLI with an API key but provides no guidance on secure credential handling, storage location, scope minimization, or avoiding disclosure in logs and shell history. While not an exploit by itself, this omission can lead to accidental credential exposure in shared terminals, screenshots, or persisted config files.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.