ClawHub
Back to skill

Security audit

supply-chain-advisory

Security checks across malware telemetry and agentic risk

Overview

This markdown-only skill gives supply-chain audit and incident-response guidance, with some sensitive commands users should handle carefully.

Before installing, understand that this skill may lead an agent to suggest broad local scans and forensic commands during supply-chain incidents. Prefer project-scoped paths when possible, treat environment snapshots as secret material, and only add any referenced hooks or external plugin behavior if you want persistent per-session dependency checks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The manifest triggers include generic terms like "security," "dependencies," and "vulnerability," plus broad situational phrases such as "handling incidents." These are not narrowly scoped to this specific supply-chain advisory skill and could cause unintended invocation during unrelated discussions.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
In a markdown skill file, safety-sensitive actions should include warnings when they may affect privacy or system integrity. Writing `env` output to `/tmp` can capture credentials, tokens, and other sensitive environment variables, but the checklist does not warn about secret exposure, file permissions, or secure handling of the snapshot.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.