ClawHub
Back to skill

Security audit

project-init

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent project scaffolding helper that makes expected local project changes with disclosed review points.

Review generated files before accepting overwrites or committing them, especially author name/email, CI workflows, Makefiles, and pre-commit configuration. Treat the referenced external attune plugin or script as separate software to inspect before installing or running.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The module documents that unresolved template variables should not remain in generated output, yet the described behavior leaves unknown placeholders unchanged. In a project scaffolding context, this can silently generate invalid or misleading configuration files, CI workflows, or build metadata that later fail unpredictably or leak placeholder content into published artifacts.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The module instructs the agent to read author name and email from local git configuration, which are personal identifiers, without explicitly warning the user or requiring consent before collection. In a project scaffolding skill this is somewhat expected behavior, but it still creates a privacy risk because the values may be inserted into generated files or shared downstream without the user realizing they were sourced from the local environment.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.