ClawHub
Back to skill

Security audit

Llm Judge

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent repo-comparison helper, but users should understand that its test-running step can execute code from the repositories they ask it to judge.

Use this skill only on repositories you trust or can sandbox. Its test step may run arbitrary project code and consume resources, so avoid pointing it at untrusted submissions on your main machine unless you are comfortable with that risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This markdown file directs the agent to execute pytest, npm/yarn test, and go test inside an analyzed repository. Running tests can execute arbitrary repository code and affect the local system, but the instructions do not warn the user about this behavior or its risks.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal