ClawHub
Back to skill

Security audit

Fd Find

Security checks across malware telemetry and agentic risk

Overview

This appears to be a normal fd command reference skill, with some risky deletion examples users should review carefully.

Installers should be comfortable with command-line file operations. Before using any example that pipes fd results into rm or uses -x rm, preview the matched files first and run it only in the intended directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill includes a destructive example (`fd -e log -0 | xargs -0 rm`) without any caution, confirmation step, or safer alternative. In an agent skill context, users may copy commands directly or an agent may surface them as recommended actions, increasing the risk of accidental mass deletion of files matching broad criteria.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The use-case example `fd --changed-before 30d -t f -x rm {}` encourages bulk deletion of files based only on age, with no warning about irreversible data loss or suggestion to validate the match set first. Because `fd` can traverse large directory trees quickly, a mistaken path, unexpected working directory, or misunderstood date filter could delete many files unintentionally.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.