ClawHub
Back to skill

Security audit

proof-of-work

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only validation skill that asks agents to prove work with tests and evidence, with some credential and network check examples users should run carefully.

Install this skill if you want stricter proof-before-done behavior. Before letting an agent run validation commands, confirm that network checks and auth-status checks are actually needed for the task, and avoid including tokens, account IDs, internal hostnames, or sensitive paths in shared evidence logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The guidance explicitly recommends network probes and credential-validation commands such as `ping`, `curl`, `gh auth status`, and `aws sts get-caller-identity` without any warning about privacy, logging, external connectivity, or the need for user consent. In an agent skill focused on validating work before completion, these commands are likely to be run routinely, which increases the chance of unintended outbound requests, account enumeration, or disclosure of environment details in captured evidence.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.