ClawHub
Back to skill

Security audit

ModelReady

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a model-serving helper, but it may start a long-running vLLM HTTP server exposed on all network interfaces by default.

Review the script before installing and prefer binding the server to 127.0.0.1 unless you intentionally want LAN exposure. Check whether the skill provides clear stop/status cleanup commands, understand where it stores defaults, PID files, and logs, and avoid running it on shared or untrusted machines without firewall and authentication controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and requires capabilities that imply shell execution, network access, and use of environment variables, but it does not declare permissions accordingly. This can mislead users and policy enforcement layers about the skill's real execution surface, increasing the chance of unintended command execution or network exposure without informed consent.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The script persists configuration in ~/.model2skill/defaults.env and manages PID/log files, creating long-lived state and service lifecycle outside the narrow expectation of 'use a model from chat'. In a skill context, hidden persistence increases surprise, makes behavior harder to audit, and can leave services configured for later reuse without explicit user awareness.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The default host is 0.0.0.0, which exposes the model server on all network interfaces by default. That can unintentionally make the service reachable from other machines on the local network or broader network segments, especially dangerous because no authentication or access controls are added by this script.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The skill launches a long-lived OpenAI-compatible HTTP server and waits for it to become reachable over the network, which materially exceeds a simple chat helper and creates a remotely accessible service. In this context, the danger is amplified because the script is framed as instant model use from chat, while actually standing up infrastructure that may be exposed to other users or systems.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to start a model server on a host/port and notes that it exposes an OpenAI-compatible endpoint, but it does not prominently warn that this creates a reachable service that may be accessible beyond the local user if bound incorrectly or used on a shared machine. In this context, the missing warning is more dangerous because the core function of the skill is to launch a server directly from chat, which normalizes network exposure without emphasizing authentication, binding, or firewall considerations.

Session Persistence

Medium
Category
Rogue Agent
Content
fi

  # start server
  nohup python3 -m vllm.entrypoints.openai.api_server \
    "${ARGS[@]}" \
    >"$LOG_FILE" 2>&1 &
Confidence
90% confidence
Finding
nohup

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.