ClawHub

Observability Designer

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local observability toolkit that reads user-supplied JSON and writes generated monitoring artifacts, with no evidence of hidden network access, exfiltration, persistence, or destructive behavior.

Review the scripts before running them, run them only on observability configs you are allowed to process, and avoid using unredacted PagerDuty keys, Slack webhooks, or other secrets in shared inputs or generated reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises three Python scripts that generate and optimize observability artifacts, and the static analyzer detected file read, file write, and network-capable behavior without any declared permissions. That mismatch is a real security issue because users and policy engines cannot accurately assess or constrain what the skill may access, especially since generated dashboards, alert configs, or integrations could read local inputs, write artifacts, or interact with external monitoring endpoints.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal