ClawHub
Back to skill

Security audit

Tripwire

Security checks across malware telemetry and agentic risk

Overview

This is a Tripwire reference skill that prints administrative examples; its sensitive examples are visible and purpose-aligned, but should be used carefully.

Install if you want a Tripwire administration reference. Do not let an agent blindly run the examples on production systems; review commands first, protect Tripwire keys and passphrases, remove plaintext policy/config files after use, and only enable email or Slack/PagerDuty alerting with approved destinations and protected webhook secrets.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The reporting example includes a direct network POST to a Slack webhook containing the hostname, which is host-identifying telemetry. Even though it appears inside documentation text emitted by the script rather than auto-executed logic, users commonly copy-paste these examples, and the script provides no warning that this transmits security event data to a third party.

External Transmission

Medium
Category
Data Exfiltration
Content
tripwire --check --quiet
if [ $? -ne 0 ]; then
    # Send to PagerDuty/Slack/etc
    curl -X POST https://hooks.slack.com/services/xxx \
      -d '{"text":"⚠️ Tripwire violation on '"$(hostname)"'"}'
fi
```
Confidence
94% confidence
Finding
This example demonstrates exfiltration of security alert metadata to an external Slack webhook via curl. In context it is not executed by the script itself, but as reference content for operators it still creates risk because it normalizes sending incident data and hostnames to third-party services without disclosure, authentication guidance, or data-minimization safeguards.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.