ClawHub
Back to skill

Security audit

Keepass-CLI

Security checks across malware telemetry and agentic risk

Overview

This skill provides broad but disclosed control over a local KeePass vault, with no evidence of hidden exfiltration or automatic unsafe behavior.

Install only if you are comfortable letting an agent operate the selected KeePass database. Keep the .env and .kdbx files permission-restricted, avoid logging commands that contain entry passwords, use --show-secrets and --include-data only when needed, and treat --permanent and create --force as high-risk operations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill declares no permissions even though detected capabilities indicate access to environment data and file reads. That mismatch is dangerous because it hides the skill's effective access from reviewers and users, reducing transparency and potentially allowing unintended access to local secrets or files when the skill is invoked.

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The documented `xml()`/`dump_xml()` capability exposes the fully decrypted KeePass database as plaintext XML, which is broader than ordinary CRUD-style secret management and materially increases exfiltration risk. In a skill whose purpose is managing a password vault, exporting all secrets at once is especially sensitive because a single misuse or prompt-injection-driven action can disclose the entire vault rather than one entry.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
Direct access to `payload`, `tree`, and generic XPath over decrypted XML allows arbitrary introspection of the entire KeePass contents, bypassing the narrower entry/group/attachment management model implied by the skill description. This expands the attack surface by enabling unrestricted enumeration and extraction of vault data if the agent is influenced to use these low-level interfaces.

Missing User Warnings

High
Confidence
79% confidence
Finding
Documenting decrypted XML export without clearly warning that it produces plaintext vault contents normalizes a highly dangerous operation and increases the chance that agents or users will expose all stored credentials. In the context of a KeePass-management skill, this is especially risky because the export can include the entire secret corpus in one artifact.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
skill.md:104