ClawHub
Back to skill

Security audit

FieldFix

Security checks across malware telemetry and agentic risk

Overview

FieldFix is a straightforward API client for managing FieldFix fleet records, with expected credential use and disclosed read/write commands.

Install this only if you want an agent or CLI to access your FieldFix account. Use a dedicated or least-privilege API key if FieldFix supports it, keep FIELDFIX_API_KEY out of chats, logs, and version control, and manually confirm machine IDs, costs, notes, and hour readings before running write commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This markdown file describes write operations such as logging service entries, logging expenses, and updating hour meters, but it does not include any user-facing warning that these commands will change persistent equipment records. Because these actions can affect operational and financial data, the skill description should explicitly disclose that they perform live updates.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The setup section instructs users to export a live API key via an environment variable, but it does not warn that the key is sensitive and should not be shared, logged, or committed. For markdown files, omission of privacy or system-integrity warnings around credentials qualifies as a missing user warning.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/fieldfix.js:22