ClawHub
Back to skill

Security audit

makefile-generation

Security checks across malware telemetry and agentic risk

Overview

This skill only provides guidance for generating standard project Makefiles and does not include hidden execution, persistence, credential handling, or data exfiltration behavior.

Before installing, know that this skill is intended for Makefile creation or updates. Review generated targets before running them, especially publish, deploy, clean, or install targets, and invoke it only when you actually want Makefile-related changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad phrases like 'automation', 'build-tools', and especially 'starting a project or standardizing build automation', which are likely to match many unrelated user requests. Overly broad activation can cause the skill to be invoked outside its intended scope, leading an agent to generate or modify Makefiles in inappropriate contexts and increasing the chance of unsafe or unintended file changes. In this skill's context, the content itself is not overtly malicious, but ambiguous triggering still expands the attack surface for accidental misuse or prompt-routing abuse.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.