ClawHub
Back to skill

Security audit

Agent Matchmaking

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only agent-discovery skill whose main caution is that it asks users to install an external Python package and may publish capability profile details if used that way.

Install only if you trust the external PyPI package, preferably after checking or pinning the version. Treat profile publishing and federation as public or semi-public sharing unless you have verified where the data goes and how it can be updated or removed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Low
Confidence
82% confidence
Finding
The skill’s invocation guidance is broad enough that it could activate on very common requests about finding, comparing, or publishing agents, without clear scoping or guardrails. In an agentic environment, over-broad triggering can cause unintended delegation or discovery flows to run when the user did not explicitly request matchmaking, which increases the chance of unnecessary data exposure or unsafe downstream actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.