ClawHub
Back to skill

Security audit

Cloudnet AI Inspection

Security checks across malware telemetry and agentic risk

Overview

This WLAN inspection skill appears purpose-aligned, but it handles and persists a Cloudnet API credential with too little explicit user control or secret-handling guidance.

Install only if you intentionally want this skill to access Cloudnet WLAN inspection data. Treat config.json and the mcporter configuration as secret-bearing, avoid committing or sharing them, consider using a safer credential mechanism if available, and remove or rotate the bearer token when the inspection access is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to place a live Cloudnet API key in a local config.json and use it in subsequent commands, but provides no guidance on secure storage, access restrictions, redaction, or avoiding accidental disclosure in logs or version control. In this context the key grants access to operational WLAN inspection data, so careless handling could expose tenant/shop network information and enable unauthorized API use.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs automatic execution of a credential-bearing mcporter config add command that embeds the bearer token on the command line and modifies local tool configuration without an explicit confirmation/safety notice. Command-line secrets may be exposed through shell history, process listings, audit logs, or shared terminals, and silent config changes can persist credentials beyond the user's intent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.