ClawHub
Back to skill

Security audit

Policy Lawyer

Security checks across malware telemetry and agentic risk

Overview

This skill is a small policy lookup helper whose local file reading is disclosed and user-directed.

Install this if you want a CLI helper for searching policy documents. Use --policy-file only with policy files you intend to inspect, and do not point it at secrets, credentials, or unrelated private files because the tool may print readable content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run_cli(args):
    return subprocess.run(
        [sys.executable, str(SCRIPT_PATH)] + args,
        capture_output=True,
        text=True,
Confidence
70% confidence
Finding
return subprocess.run( [sys.executable, str(SCRIPT_PATH)] + args, capture_output=True, text=True, cwd=SKILL_DIR, )

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.