ClawHub
Back to skill

Security audit

Fulcra Annotations

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Fulcra integration for creating and recording annotations, with documentation inconsistencies users should notice but no artifact-backed malicious behavior.

Install only if you want an agent to write annotation definitions or annotation events into your Fulcra account. Treat notes, health or behavior logs, timestamps, values, and tags as private data sent to Fulcra. Use the bundled list/create/record/recent helper, confirm writes explicitly, avoid relying on update/delete guidance until the publisher makes that workflow consistent, and prefer a minimal environment when running the helper in secret-rich agent hosts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The README presents inconsistent security-relevant behavior: earlier it states the skill can create, update, and delete annotation definitions, but later says the bundled helper intentionally exposes only list, create, record, and recent. That mismatch can cause operators or downstream agents to assume destructive operations are unavailable when they may actually exist, weakening approval and change-control expectations around write/delete actions.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The documentation is internally inconsistent: one section says the helper intentionally exposes only `list`, `create`, `record`, and `recent`, while later workflow/tag guidance instructs users to perform `update` operations. In practice, this can cause agents to bypass the reviewed helper and fall back to ad hoc or direct API calls for mutation, increasing the chance of unsafe state changes, policy bypass, or use of unreviewed tooling.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The default prompt, "Create or record a Fulcra annotation," is broad enough to trigger this skill for ordinary user requests involving notes, logging, or annotations, even when the user did not explicitly intend to invoke Fulcra Life API write actions. Because this skill performs state-changing operations, ambiguous activation increases the risk of unintended external writes, incorrect records, or workflow misuse.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
if env_token:
        return env_token.strip()

    env = os.environ.copy()
    env["HOME"] = DEFAULT_HOME
    if os.environ.get("FULCRA_HOME"):
        env.setdefault("UV_TOOL_DIR", str(Path(PROCESS_HOME) / ".local" / "share" / "uv" / "tools"))
Confidence
76% confidence
Finding
Copying the full process environment into a child process can leak unrelated secrets to the invoked CLI, especially in agent environments that often carry many credentials in environment variables. Even though the command is restricted, any compromised, trojaned, or unexpectedly-behaving 'fulcra-api' binary would receive the entire environment and could exfiltrate those secrets.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.