ClawHub
Back to skill

Security audit

bloat-detector

Security checks across malware telemetry and agentic risk

Overview

This skill is a codebase bloat analysis guide with purpose-aligned repository scanning and no evidence of hidden exfiltration, automatic deletion, or persistent privileged behavior.

Install only if you want an agent to inspect your repository for bloat using shell and git commands. Run it from a clean working tree, review any suggested cleanup before approval, and be aware that some example scans may create temporary or report files in the project directory and may query package registries for dependency validation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes broad, common phrases such as 'cleanup', 'optimization', and especially 'before a release', which can cause this skill to activate during ordinary development conversations unrelated to bloat analysis. Over-broad activation increases the chance of unintended context injection, unnecessary tool/workflow steering, and interference with user intent, which is a genuine security and safety concern for agentic systems even though the content itself is not overtly malicious.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The stale-file scan creates and later deletes a fixed temporary file, `recent_files.txt`, in the current working directory without warning. This can overwrite an existing file, interfere with concurrent runs, and unintentionally modify the user's repository state; the final `rm` also operates on a predictable filename rather than a securely created temporary path.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.