ClawHub
Back to skill

Security audit

ggshield Secret Scanner

Security checks across malware telemetry and agentic risk

Overview

This secret-scanning skill mostly does what it says, but it should be reviewed because its privacy claims understate what may be sent to GitGuardian when scanning code.

Install only if you are comfortable letting an agent run ggshield on selected repositories, files, staged changes, or Docker images. Use a revocable GitGuardian API key, verify the ggshield binary and package source, avoid scanning code that cannot be shared with GitGuardian under your policy, and require explicit approval before installing git hooks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The skill description frames the behavior as simple secret scanning, but the documented commands also install git hooks and scan Docker images, which extends its operational reach and can modify repository state. This mismatch can mislead users and downstream policy systems into granting trust or permissions without realizing the skill can alter local git configuration and inspect additional assets.

Intent-Code Divergence

High
Confidence
95% confidence
Finding
The Privacy & Security section makes a strong claim that only metadata is sent and that file contents or secrets are never transmitted, but this is inconsistent with how remote secret scanning tools commonly operate and conflicts with the documented use of GitGuardian API-backed detection. If users rely on this claim, they may scan sensitive repositories under false assumptions and unintentionally disclose source content or secrets to a third party.

Unvalidated Output Injection

High
Category
Output Handling
Content
env = {**os.environ, self.api_key_env: api_key}

        result = subprocess.run(
            command,
            capture_output=True,
            text=True,
Confidence
76% confidence
Finding
subprocess.run( command, capture_output

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.