ClawHub

LobsterBio - Dev

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Lobster AI development skill with normal developer guidance and no hidden execution behavior.

Install this skill only for Lobster AI development. Before following its examples, work in a trusted repository and isolated environment, review package install or upgrade commands, use least-privileged provider credentials, and remember that Lobster workspaces may retain sessions, provenance, cache files, and exported notebooks on disk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes very broad terms such as "contribute," "fix bug," "add feature," and "write tests," which are common across many software tasks and could cause this skill to activate outside the intended Lobster-specific context. Unintended invocation can route users into irrelevant project-specific guidance, increasing the chance of mistaken actions, confusion, or misuse of repository-specific commands in the wrong environment.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation explicitly states that sessions persist conversation history and workspace state, and shows disk-backed state under `.lobster/session.json`, but it does not warn users that potentially sensitive prompts, outputs, and derived data may remain on disk. In a bioinformatics tool, persisted session state can include dataset identifiers, analysis context, and possibly sensitive research or regulated data, increasing the risk of unintended disclosure on shared systems.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The export workflow describes generating Jupyter notebooks without warning that exported notebooks may embed prompts, analysis history, code, outputs, metadata, or references to prior session content. Users may share or publish these notebooks assuming they contain only final results, which can leak sensitive data or internal context.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal