ClawHub

Code Review

Security checks across malware telemetry and agentic risk

Overview

This is a coherent code-review skill that may read local git diffs when asked to review recent changes, with no evidence of hidden exfiltration, persistence, or destructive behavior.

Install this if you are comfortable with an agent inspecting code snippets, PR diffs, or local git changes for review. For sensitive repositories, ask it to review a specific pasted diff, staged changes, commit, branch, or file rather than giving a broad request like reviewing recent changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases include broad, common user expressions such as “帮我看看代码” and “这段代码有问题吗”, which can overlap with ordinary conversation and cause the skill to activate unexpectedly. In an agent environment, overbroad activation can route unrelated user input into code-review workflows, increasing the chance of unintended file access, repository inspection, or disclosure of local development context.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to proactively run `git diff` when in a working directory, but it does not require explicit user consent or provide a clear notice that local repository contents will be accessed. Because diffs can contain proprietary code, secrets, credentials, comments, or uncommitted work, this creates a meaningful risk of unauthorized data exposure beyond what the user intended to share.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal