ClawHub
Back to skill

Security audit

Agent Security Audit

Security checks across malware telemetry and agentic risk

Overview

This is a defensive prompt-injection checklist skill with example scripts, and its risky examples are visible rather than hidden or automatic.

Install only if you want a defensive checklist for prompt-injection handling. Treat all code blocks as examples: run them only on copies of data, avoid privileged log paths unless intentionally configured, and do not treat the promotional external link as vetted security guidance.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The markdown includes shell examples that modify files in place with sed -i and write to /tmp and /var/log without an explicit warning that these commands alter inputs and leave artifacts. In a security-focused skill, users may copy-paste these examples directly; this can overwrite source data, leak sensitive content into logs, or create unsafe assumptions about handling untrusted input.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.