ClawHub
Back to skill

Security audit

Hugo Blog Agent

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Hugo blog setup and deployment guide with disclosed admin and network-check examples, but no hidden execution or data theft behavior.

Install this skill if you want help building and deploying a Hugo blog. Review the nginx configuration, external theme source, and any sudo/systemctl command before allowing an agent to run them, and only run the curl validation against domains you control or have permission to test.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill extends beyond Hugo blog construction into server administration by including nginx deployment, log configuration, and a privileged reload path using sudo/systemctl. This broadens the agent's operational scope and could enable unintended infrastructure changes if the skill is invoked in an environment where it has host-level access.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The SEO check script performs live network requests with curl against arbitrary URLs, which adds external probing capability not strictly required for local Hugo blog construction. In an agent context, this can be abused for unintended outbound requests, environment-dependent scanning, or validating attacker-controlled endpoints.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.