ClawHub
Back to skill

Security audit

Clawhub Skill Scanner

Security checks across malware telemetry and agentic risk

Overview

This appears to be a purpose-aligned security scanning skill, with only a minor activation-scope concern to be aware of.

This skill looks reasonable to install if you want an extra pre-install security scanner. Expect it may activate when you discuss installing or adding skills; review its output as advisory and keep normal caution around any scanner that reads local skill artifacts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrases are broad enough to match ordinary conversation about installing or adding skills, which can cause the skill to run unexpectedly. In a security-gatekeeper skill this is less dangerous than in an execution-heavy skill, but it still creates unnecessary autonomous activation and may interfere with normal workflows or be abused to force scans in unintended contexts.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/scan_skill.py:72