ClawHub
Back to skill

Security audit

Code Graph（代码图谱）

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed GitNexus setup helper, but it can make persistent local tooling and project-state changes that users should approve deliberately.

Install only if you want GitNexus configured on this machine. Before running it, explicitly approve global npm installation, MCP/editor configuration writes, repository indexing, .gitignore updates, and any git init/add/commit step, especially in projects with secrets or uncommitted work.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs a global npm installation and runs `gitnexus setup`, which writes MCP/editor configuration outside the project, but it does not clearly warn the user that system-wide state will be modified. In an agent context, these side effects can surprise users, alter trusted tooling configuration, and persist beyond the current task.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The troubleshooting flow instructs `git init && git add . && git commit -m "initial"` without warning that it creates a repository and snapshots all current files. This can unintentionally version sensitive files, alter repository state, and create persistent history the user did not intend.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.