ClawHub

IPFS Server

Security checks across malware telemetry and agentic risk

Overview

This skill performs expected IPFS server setup and administration, with sensitive network and install steps that users should review before running.

Install only if you intend to run an IPFS node. Review the Kubo download source before using sudo, bind gateway/API endpoints to localhost unless public access is intentional, use firewall rules for exposed services, monitor storage and bandwidth, and pass pinning JWTs through environment variables or a secret manager rather than typing real tokens directly into commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README instructs users to initialize and launch an IPFS daemon in the background and advertises gateway services, but it does not warn that an IPFS node opens network-facing services, consumes storage/bandwidth, and may expose content or APIs depending on configuration. In the context of an IPFS server skill, this omission is material because users may blindly follow the quick start and unintentionally run a reachable node or gateway with broader exposure than expected.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill shows a command that embeds a JWT directly on the command line as `YOUR_JWT` without warning against hardcoding, shell history leakage, process-list exposure, or safer secret handling methods. In an operational admin skill, users may copy this pattern verbatim and unintentionally expose a real remote-pinning credential to local users, logs, terminal history, or shared documentation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal