ClawHub
Back to skill

Security audit

Q&A Prep Partner

Security checks across malware telemetry and agentic risk

Overview

This is a simple local presentation Q&A helper with user-directed file reading and no evidence of hidden network, credential, persistence, or destructive behavior.

Reasonable to install for local Q&A preparation. Only pass abstracts or file paths you intend the tool to read; despite the documentation mentioning output files, this version appears to print results to the terminal rather than saving them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill documentation explicitly instructs users to run a local Python script and indicates file output behavior, but it does not present a prominent warning that executing the tool affects the local system and writes files. While the described behavior is expected for a local utility and there is no direct evidence of malicious functionality in this file, the lack of clear user-facing warnings can lead to unsafe execution assumptions, especially for users who treat skills as passive prompt assets rather than executable tooling.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.