ClawHub

Synero

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Synero API client that clearly exists to send a user-provided prompt to Synero and return a synthesized AI answer.

Install only if you are comfortable sending the prompts you provide, plus any thread or parent query IDs, to Synero's remote API. Use a revocable API key, avoid secrets, personal data, customer data, regulated information, or proprietary source code unless approved for that service, and only set SYNERO_API_URL to an endpoint you trust.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill clearly requires environment variables and performs outbound network access, but the skill metadata does not declare explicit permissions for those capabilities. This weakens transparency and permission enforcement, making it easier for a user or host system to run a networked skill without clear security review of its access to secrets and external services.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation says prompts are sent to Synero's external API, but it does not prominently warn that user-supplied prompt content may leave the local environment and be processed by a third party. Users may paste sensitive material such as source code, credentials, customer data, or strategy documents without realizing the privacy and compliance implications.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal