ClawHub
Back to skill

Security audit

Github Repo Ops

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only helper for analyzing public GitHub repositories and does not request credentials, write access, persistence, or local data access.

Install this if you want help summarizing and comparing public GitHub repositories. Be aware it may activate for many GitHub-related prompts, and it should not be used for private repositories, write operations, or as a definitive security audit.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill’s activation description is very broad and can match many ordinary GitHub-related requests, making it likely to trigger in contexts beyond its narrow intended purpose. Over-broad activation increases the chance that the skill is invoked unnecessarily, which can crowd out more appropriate tools or cause the agent to route sensitive repository-analysis prompts through this skill without clear user intent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.