ClawHub
Back to skill

Security audit

feature-review

Security checks across malware telemetry and agentic risk

Overview

This roadmap review skill is mostly coherent, but it tells the agent to run a local deferred-capture script automatically after a planning decision, without a separate confirmation or clear storage scope.

Review this skill before installing. It is not clearly malicious, but you should only use it in repositories where you trust any `scripts/deferred_capture.py` it might run, and you should disable or require explicit confirmation for deferred capture unless you want skipped high-priority suggestions written locally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to automatically execute a local Python script for deferred capture, which extends beyond its stated core purpose and performs a side effect on the local environment. Automatic local code execution without an explicit per-action confirmation creates a security boundary violation and could be abused if the script or its inputs are modified to perform unexpected actions.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The skill first states that issue creation requires user confirmation, but then introduces an automatic deferred-capture path that runs without prompting. This inconsistency can mislead users about when the agent will perform side effects, undermining informed consent and increasing the chance of unexpected file writes or script execution.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger list includes broad planning terms such as roadmap and sprint-prioritization language, making accidental invocation more likely during ordinary conversations. In this skill, accidental activation is more dangerous because the workflow includes follow-on actions like GitHub issue creation and automatic deferred capture.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explicitly says deferred capture runs automatically without prompting, yet does not provide a clear warning that this will execute a local script and write data. Hidden or under-disclosed side effects are dangerous because users may believe they are only reviewing prioritization output while the agent is actually modifying the local environment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.