ClawHub
Back to skill

Security audit

Anomaly Watcher

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local anomaly monitor, but it can create persistent workspace logs of agent activity that may contain sensitive operational details.

Install this only in workspaces where persistent local monitoring logs are acceptable. Review what metric details are passed into the skill, protect or exclude the .security directory from sharing or source control, and periodically purge old logs if they may contain prompts, file paths, session IDs, or security findings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly logs user prompt submissions and every tool invocation, but it does not disclose any privacy notice, consent mechanism, retention policy, or data-minimization controls. Because prompts and tool activity can contain sensitive user data, secrets, file paths, or operational context, this creates a real privacy and compliance risk even if the monitoring goal is defensive.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill persistently writes telemetry entries, including arbitrary `metric.details` and session identifiers, to `.security/baseline/metrics.jsonl` without any consent, disclosure, minimization, or retention controls. In a monitoring skill, this can quietly accumulate sensitive operational data on disk and expose behavior traces to other local users, later processes, backups, or source-control mistakes.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill appends anomaly findings to `.security/anomalies.jsonl` as a persistent incident log without warning, which can reveal sensitive behavioral patterns, suspected incidents, and operational baselines over time. In this skill's context, those records may be especially revealing because they summarize potentially suspicious activity and could aid internal surveillance, leak investigative context, or expose incident history if accessed by unauthorized parties.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.