ClawHub

Cargo

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Cargo CLI helper skill whose credential use, workspace writes, and administrative examples match its stated purpose, though users should treat it as a powerful workspace-management tool.

Install only if you intend to let an agent operate your Cargo workspace. Use a dedicated, least-privilege token where possible, confirm the active workspace before writes, and review any commands that create tokens/users, sync to CRM, push context files, deploy hosting resources, or refresh installed Cargo skills.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The use case explicitly instructs `context runtime write` and notes that it pushes to the default branch, but it provides no warning that this mutates shared workspace context data or may trigger downstream automation and audit implications. In an agent-skill context, omission of mutation warnings increases the chance of unintended writes to production-like repositories, especially when users may treat examples as safe read-only recipes.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The bootstrap workflow includes `workspaceManagement token create` without any notice that the resulting API token is a sensitive credential that must not be logged, shared, or stored insecurely. In an agent-oriented CLI skill, examples are often copied verbatim, so failing to warn about token handling materially increases the risk of credential leakage and unauthorized workspace access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal