DevOps Pipeline Pro

• Outcome: Pass
• Latest audit: Jun 13, 2026 at 3:44 AM UTC
• Version:
  1.0.0

Overview

This skill is intended for high-impact production data migrations, and its instructions clearly require dry runs, backups, explicit confirmation, verification, and cleanup.

Install this only if you want an agent to help with ClawHub Convex production migrations or destructive cleanup workflows. Treat any production apply step as sensitive: verify the target deployment, review dry-run output, make a manual backup, and give explicit confirmation only when the plan and expected impact are clear.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises deployment, rollback, and infrastructure-changing capabilities without a prominent warning at the capability description point that these actions can modify live systems. In a DevOps automation context, unclear safety messaging can lead users to trigger destructive or production-impacting operations unintentionally, especially because the skill covers Kubernetes, IaC, and rollback flows.

VirusTotal

64/64 vendors flagged this skill as clean.