ClawHub
Back to skill

Security audit

Agent Communication

Security checks across malware telemetry and agentic risk

Overview

The skill appears to support multi-agent handoff behavior, with no artifact-backed evidence of deception, exfiltration, or destructive actions.

Install only if you are comfortable with agent-to-agent handoffs. Do not include passwords, API keys, private business data, or sensitive personal details in tasks that may be forwarded to another agent unless you trust that agent and its workspace.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The template explicitly directs agents to forward the user's original request and the current source sessionKey to another agent as a standard practice, without any minimization, consent, or sensitivity checks. This can expose sensitive user data and internal session identifiers to downstream agents unnecessarily, increasing the risk of data leakage, cross-session misuse, or unauthorized message routing if a target agent is compromised or incorrect.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.