ClawHub
Back to skill

Security audit

HiLink LTE Modem

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate LTE modem-control skill, but it can send or delete SMS and use a saved SIM PIN, so users should operate it deliberately.

Install this only if you want an agent or CLI to control your local HiLink modem. Protect ~/.config/hilink/config, avoid storing HILINK_PIN unless unattended unlock is truly needed, restrict the config file to your user, list/read SMS before deletion, and review any SMS send, PIN disable, USSD, or sudo network command before allowing it to run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill documents SMS deletion as a routine command without warning, backup guidance, or confirmation expectations. Because SMS may contain one-time codes, billing records, or personal communications, silent or accidental deletion can cause data loss and interfere with account recovery or auditing.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script automatically reads a SIM PIN from a user config file and submits it to the modem whenever the SIM reports a locked state. While this is operationally convenient, it causes a sensitive credential to be stored persistently and used without an explicit per-use prompt or warning, increasing the chance of accidental disclosure, misuse by other local processes/users, or unintended unlock attempts.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The SMS deletion command immediately performs a destructive action against the modem inbox without any confirmation, dry-run mode, or clear warning. In a CLI skill that may be called by an agent or automation, this can lead to accidental loss of messages that may contain one-time codes, account notices, or forensic evidence.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.