ClawHub
Back to skill

Security audit

Nvidia Agent Fleet

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it advertises, but its automatic API-key discovery runs local shell configuration and reads credential files in a way that warrants review.

Review before installing. Use an explicit NVIDIA_API_KEY instead of relying on auto-discovery, avoid running it where ~/.zshrc contains side-effectful commands, and do not send secrets or private data in prompts because task content is transmitted to NVIDIA's API.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
dispatcher/fleet.py:29
Finding

Unsafe Execution of Shell Startup Configuration During API-Key Discovery

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description focuses on agent dispatching, but it also discloses automatic credential discovery from ~/.zshrc and local config files plus external API usage without prominent security disclosure. Accessing local shell configuration and config files for secrets can expose unrelated credentials or sensitive user data, especially when combined with network access.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill description focuses on agent dispatching, but it also discloses automatic credential discovery from ~/.zshrc and local config files plus external API usage without prominent security disclosure. Accessing local shell configuration and config files for secrets can expose unrelated credentials or sensitive user data, especially when combined with network access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The prompt directs the model to give step-by-step reasoning before the conclusion, which pressures it to externalize internal deliberative traces. In an agent fleet context, this increases the chance of unnecessary disclosure of hidden reasoning and can make prompt manipulation or policy circumvention easier across downstream consumers.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The prompt for the thinking model explicitly instructs the assistant to reveal its full chain of thought. This is dangerous because it encourages disclosure of internal reasoning that may expose hidden policy logic, increase prompt-injection susceptibility, and leak sensitive intermediate analysis that should remain internal.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises capabilities that imply environment access, filesystem access, shell usage, and network operations, but it does not declare any explicit tool scope or permissions. This is dangerous because users and hosting platforms cannot accurately assess or constrain what the skill may access, increasing the risk of over-privileged execution and unintended data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description and operational instructions are presented entirely in Chinese, which effectively forces a specific language for users of the skill. The file does not indicate that Chinese is optional, nor does it justify the locale restriction as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that the skill automatically discovers API keys from shell configuration and local files but does not provide a clear warning that sensitive local credentials will be accessed. Lack of transparent disclosure can lead users to run the skill without understanding that it may inspect files containing secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JSON manifest contains natural-language instructions such as "用流畅的中文回答" that require responses in Chinese by default. The policy only allows locale or language constraints when the skill offers user choice or clearly documents a justified region-specific limitation, which is not present for these general assistant entries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains natural-language system prompts that explicitly require Chinese responses, such as '用流畅的中文回答'. The policy for this audit flags language or locale constraints when they are imposed without user opt-in or a clearly documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Multiple entries in this section describe the models as Chinese-focused and constrain behavior around Chinese dialogue or deep Chinese understanding. Because the prompts do not offer language selection or note that the locale restriction is intentional and scoped, they create a policy issue under the audit rules.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The module description and embedded natural-language strings present the skill as a Chinese-language dispatcher, and the task routing logic includes a dedicated Chinese category without any visible language-choice mechanism. This can violate language or locale policy when the skill effectively assumes a specific language without offering user opt-in or alternatives.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The dispatcher performs broad credential discovery by searching environment variables, shell startup files, and unrelated local app configuration. This exceeds the minimum access needed for task routing and creates unnecessary exposure of secrets from other tools and user contexts. Such secret harvesting behavior increases the blast radius if the component is misused or later extended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code silently discovers and reuses an API key from local files, then injects it into the process environment for later requests. This handles sensitive credentials without explicit user disclosure or consent, which can surprise users and violate least-privilege expectations. In an agent skill, hidden secret acquisition is risky because users may not realize local credentials are being consumed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

The code spawns a shell and sources the user's ~/.zshrc to recover NVIDIA_API_KEY. Sourcing shell startup files executes arbitrary commands embedded in that file, so merely running the dispatcher can trigger unintended code execution under the current user's privileges. In a routing utility, this is especially dangerous because credential lookup should not require command execution.

Content

Scanner excerpt · dispatcher/fleet.py (reported line 33)May include surrounding context.

python
if os.path.exists(zshrc):
        try:
            import subprocess
            result = subprocess.run(
                ["bash", "-c", f"source {zshrc} && echo $NVIDIA_API_KEY"],
                capture_output=True, text=True, timeout=5
            )

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · dispatcher/fleet.py (reported line 254)May include surrounding context.

python
"recommendations": selected
    }

def call_model(model, system_prompt, user_message, temperature=0.3, max_tokens=2048, timeout=None):
    """调用 NVIDIA API（线程安全，带超时控制）"""
    global API_KEY
    if not API_KEY:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

User task content is sent to an external NVIDIA API endpoint, but the dispatcher provides no explicit privacy warning or consent gate before transmission. Tasks may contain proprietary code, credentials, personal data, or internal business information, so silent exfiltration to a third party creates confidentiality risk. The skill context makes this more serious because it auto-routes and can send arbitrary user prompts upstream by default.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

Automatic API key discovery from ~/.zshrc and local config files goes beyond a minimal dispatch function and reads files that may contain unrelated secrets, aliases, tokens, or personal configuration. Even if intended for convenience, this broad local file access increases the blast radius of misconfiguration and could expose sensitive material to the skill runtime.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The prompt instructs the agent to analyze stocks specifically for the Chinese A-share market and to account for that market's characteristics. Locale-specific behavior can be acceptable when clearly documented and justified, but this code-level prompt does not indicate user opt-in or broader skill-level scope constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.