ClawHub
Back to skill

Security audit

Agent Orchestration

Security checks across malware telemetry and agentic risk

Overview

This markdown-only skill is purpose-aligned for prompting and managing sub-agents, with expected local note-taking and builder/research templates but no hidden execution or exfiltration behavior.

Install if you want reusable templates for directing and tracking sub-agents. Before use, set explicit workspace paths, command limits, research boundaries, and approval rules for destructive or sensitive actions. Do not write secrets, credentials, private customer data, or confidential project details into active-agents.md or LEARNINGS.md.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs users to maintain a persistent `active-agents.md` file tracking spawned agents, tasks, timings, and statuses, but it does not warn that operational details will be recorded to disk. In an orchestration context, those entries can contain sensitive project names, research topics, timing metadata, or other workflow details that create an avoidable privacy and information exposure risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs users to maintain `LEARNINGS.md` with approaches, outcomes, and lessons learned, which can easily capture sensitive prompts, internal results, failures, and project context. Because the skill presents this as normal workflow without disclosure or safeguards, it encourages persistent storage of potentially confidential information that may later be exposed through local access, repo commits, or sharing.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The template explicitly instructs a builder agent to create or modify files at a caller-supplied target location, but it does not require confirmation, path validation, sandboxing, or any warning about filesystem side effects. In an agent-orchestration context, this increases the risk of unintended overwrites, writes to sensitive paths, or prompt-driven abuse if untrusted inputs populate the output path.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The 'Competitive Intel' variation explicitly includes 'Weakness exploitation opportunities,' which encourages adversarial analysis of competitors without any ethical, legal, or policy guardrails. In an agent-orchestration skill, this is more dangerous because it can be reused as a prompt template to scale questionable competitive-intelligence tasks across sub-agents, increasing the chance of misuse for unethical targeting or improper information gathering.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.