ClawHub
Back to skill

Security audit

CORS Scanner

Security checks across malware telemetry and agentic risk

Overview

The available evidence points to a security scanning skill with one notable reliability issue, not hidden or malicious behavior.

Before installing, check whether HTTPS certificate verification is disabled by default. If so, use the skill only against targets you control and treat scan results as potentially unreliable unless the tool verifies TLS normally or requires an explicit insecure-mode flag.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The scanner disables TLS certificate validation by setting `check_hostname = False` and `verify_mode = ssl.CERT_NONE` for all HTTPS requests. This makes scan results untrustworthy and allows a man-in-the-middle attacker to intercept or alter responses, potentially causing false negatives/positives or exposing scanned request metadata; in a security tool, that materially undermines the integrity of the assessment.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/cors_scan.py:53