ClawHub
Back to skill

Security audit

Wiki Entry Skill

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate local wiki-maintenance skill, but it should be reviewed because it can change many local files and includes a broad shell-command audit hook.

Install only if you are comfortable giving this skill high-trust access to edit, move, and audit files in a configured markdown vault. Set all vault and wiki paths explicitly, keep backups or version control, avoid broad QMD/history collections unless needed, and treat any --audit-cmd value as trusted shell code.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill performs file reads, file writes, and uses environment-provided paths, but it does not declare explicit permissions or constraints for those capabilities. Because it is user-invocable and operates on configurable filesystem locations, this creates an authorization gap: the runtime and reviewers cannot reliably enforce or audit what files the skill may access or modify, increasing the risk of unintended or unsafe file operations if configuration is wrong or manipulated.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The workflow explicitly instructs the agent to write task-derived decision records and execution notes into personal memory and context logs outside the immediate wiki-entry artifact set. This creates a cross-task data persistence channel that can unintentionally retain sensitive operational details, user content, or derived metadata beyond the original task scope, increasing the risk of data leakage and unauthorized reuse in later sessions.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The workflow requires querying historical agent memory, including contradiction history, as part of routine processing. Pulling in broad prior memory can expose unrelated sensitive information to the current task and can cause scope creep, where data from other users, sessions, or topics influences output without a strict need-to-know boundary.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
This script executes the value of --audit-cmd via `bash -lc`, which allows arbitrary shell execution under the privileges of the caller. In a checkpoint/status helper, that is unnecessarily powerful and dangerous because any untrusted or indirectly influenced input can become command injection, leading to arbitrary file modification, data exfiltration, or code execution within the vault environment.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.