ClawHub
Back to skill

Security audit

windows-shell

Security checks across malware telemetry and agentic risk

Overview

This Windows encoding skill is coherent and disclosed, but its optional setup changes persistent user-level shell and Git settings that users should review first.

Install is reasonable for Windows users who specifically need GBK/UTF-8 shell compatibility. Before running any --setup-env or one-click setup command, review the persistent changes to user environment variables, ~/.bash_profile, ~/.bashrc, and global Git config, and be prepared to revert them if they affect other tools or repositories.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README instructs users to run a setup flow that persistently modifies Windows user environment variables, shell startup files, and global Git configuration, but it does not clearly foreground that these are lasting, system-wide user changes. This can surprise users, alter unrelated tooling behavior, and create difficult-to-diagnose compatibility issues across future shells and repositories.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
Forcing LANG=en_US.UTF-8 in shell startup files changes the user's locale behavior globally for interactive Git Bash sessions, not just encoding. Locale affects sorting, messages, parsing, and tool behavior, so hard-coding a specific language/locale can break workflows or silently change output expected by scripts.

Natural-Language Policy Violations

Medium
Confidence
81% confidence
Finding
The skill instructs users to set LANG=en_US.UTF-8 as part of persistent shell configuration without opt-in or discussion of side effects. Forcing locale settings globally can alter command behavior, sorting, parsing, and downstream script assumptions, creating operational risk and potentially causing security-relevant misparsing in automation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.