ClawHub
Back to skill

Security audit

Fzf Fuzzy Finder

Security checks across malware telemetry and agentic risk

Overview

This is a coherent fzf usage guide that only installs fzf, but some optional examples can be harmful if copied without review.

Install this only if you want fzf command-line help and are comfortable reviewing shell snippets before using them. Avoid the history replay alias, add confirmation to deletion or kill commands, and verify Docker or Kubernetes context before running any admin examples.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation includes destructive examples such as deleting selected files and force-killing processes without any warning, confirmation step, or safer variant. In an agent skill context, users may copy commands verbatim, so these examples materially increase the risk of accidental data loss or service disruption.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The `fh` alias selects a history entry and executes it via `sh -c`, which can re-run arbitrary prior shell commands with no review or confirmation. This is especially risky because shell history may contain destructive, credential-bearing, or context-specific commands that become dangerous when replayed unintentionally.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.