ClawHub
Back to skill

Security audit

GoldenSeed

Security checks across malware telemetry and agentic risk

Overview

GoldenSeed is a straightforward reproducible-randomness helper with no evidence of hidden access, data theft, persistence, or destructive behavior.

Install it like any third-party Python package: use a virtual environment where possible, pin or review `golden-seed` for controlled builds, and do not use it for passwords, keys, tokens, cryptography, or security-sensitive randomness. Treat the procedural-generation examples as illustrative and verify seeding behavior before relying on them for fairness or reproducibility guarantees.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The documentation claims that a caller-provided seed controls the generated output, but the example code ignores the seed value and always creates `UniversalQKD()` with its default state. In a skill explicitly marketed for reproducibility, fairness, and verifiable generation, this can cause all users to unknowingly produce the same sequence, undermining test isolation and any process that assumes per-seed determinism.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The world-generation example states that chunk output is determined by coordinates, but `x` and `z` are never used; output depends only on generator progression. This can mislead users into believing chunk generation is location-stable and independently reproducible, when in reality results vary by call order, which can break consistency guarantees and any fairness or verification logic built on top of the example.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.