Security audit
Claw Brain
Security checks across malware telemetry and agentic risk
Overview
ClawBrain is a disclosed memory-and-secrets tool, but this reviewed package mostly delegates sensitive setup to external code while its documentation no longer matches the packaged artifacts.
Install only if you trust the external ClawBrain PyPI package or GitHub source. Before running setup, verify the source version, review the hook code, understand that memories and profiles may persist locally unencrypted unless marked as secrets, and protect the database, encryption key, and key backups like sensitive credentials.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.