ClawHub
Back to skill

Security audit

Live Preview

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it exposes local development servers to the public internet and includes risky remote-script install shortcuts without enough safety guidance.

Install only if you are comfortable making the selected local preview publicly reachable. Prefer the pip or uv install path, avoid the curl-to-bash or iex shortcuts, expose only a minimal intended app or directory, avoid authenticated or sensitive environments, and stop the dev server and tunnel when done.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to expose a local development server to the public internet and share the resulting URL, but it does not warn about the risk of unintentionally publishing sensitive local content, debug endpoints, source maps, admin interfaces, or in-progress code. In this context, the danger is elevated because development servers commonly run with weaker defaults and broader access than production services, making accidental data exposure more likely.

External Script Fetching

High
Category
Supply Chain
Content
## CLI Reference

The `aitun` command (installed via `pip install aitun`, or alternatively `curl -fsSL https://aitun.cc/install.sh | bash` / `irm https://aitun.cc/install.ps1 | iex` on Windows) accepts these flags:

| Flag | Description |
|---|---|
Confidence
98% confidence
Finding
curl -fsSL https://aitun.cc/install.sh | bash

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.