ClawHub
Back to skill

Security audit

Agenthost

Security checks across malware telemetry and agentic risk

Overview

This appears to be a purpose-aligned publishing skill, but users should understand that uploaded files and private share links can expose hosted content.

Before installing or using this skill, confirm that you intend to publish the selected files to agenthost.page. Do not upload secrets, private documents, or proprietary material unless external hosting is acceptable, and avoid sharing the generated private link in public chats, logs, screenshots, or issue trackers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to upload file contents via curl to an external domain, but it does not clearly foreground that local files and documentation are being transmitted to a third-party hosting service. In an agent setting, this can cause accidental exfiltration of sensitive internal documents, build artifacts, or proprietary site contents when a user only intended local packaging or preview.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Although the document mentions a 'private, pre-authenticated share link,' it does not clearly warn that possession of that URL grants access to the published content and may set an authentication cookie on first load. This makes the link effectively a bearer secret, so accidental disclosure in chats, logs, browser history, screenshots, or referrers can immediately expose the hosted material to unintended parties.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.