ClawHub
Back to skill

Security audit

monorepo-scaffold

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed monorepo scaffolder that asks before writing and keeps its file and command authority aligned with building a new project skeleton.

Install this only if you want an agent to create real project files and run package-manager verification commands. Use an empty or dedicated folder when possible, and review the proposed scaffold plan before approving writes or git initialization.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Self-Modification

High
Category
Rogue Agent
Content
## Safety check

Before touching the filesystem:
- Confirm the target directory exists and list its contents. If it's not empty, stop and tell the user what's already there, then ask whether to proceed (merge into existing files), scaffold into a subfolder instead, or abort. Never silently overwrite existing files.
- Confirm whether the user wants git initialized here, or whether this folder is already inside a git repo (check for a `.git` directory, including in parent directories) — don't run `git init` inside an existing repo without asking.

## The interview
Confidence
80% confidence
Finding
overwrite existing file

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.