ClawHub
Back to skill

Security audit

Self Optimization

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local workflow for saving useful lessons and reminders, with a real privacy hygiene concern but no evidence of hidden exfiltration or destructive behavior.

Install this only if you want local persistent learning files and reminder hooks. Before saving or promoting entries, remove secrets, tokens, customer data, private prompts, proprietary details, and sensitive personal or business context; keep entries summarized and review any changes to agent guidance files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Ssd 3

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to persist user corrections, project conventions, missing capabilities, and related work context into local files. That creates a durable natural-language retention channel for potentially sensitive user or project data, which may later be searched, promoted, or reused outside the original context.

Ssd 3

Medium
Confidence
97% confidence
Finding
The error template asks for full error output and 'Relevant inputs,' both of which commonly contain secrets, access tokens, file contents, prompts, URLs, or customer data. Because the destination is a persistent markdown log, this can transform transient sensitive material into long-lived plaintext records that are easier to leak, index, or accidentally commit.

Ssd 3

Low
Confidence
86% confidence
Finding
Recording what the user wanted and why can preserve sensitive business intent, internal priorities, or personal context beyond the immediate task. In this skill, that risk is amplified because the information is intentionally retained for future sessions and may be promoted into broader guidance files.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.