ClawHub
Back to skill

Security audit

Nomad

Security checks across malware telemetry and agentic risk

Overview

This is a read-only Nomad troubleshooting skill, but some documented queries can show sensitive cluster logs, variables, or metadata.

Install only if you want an assistant to help query your Nomad cluster. Use a least-privilege read-only Nomad ACL token where possible, verify the target address/namespace/region before running commands, and treat allocation logs and Nomad variables as confidential; redact sensitive output before sharing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill description presents a narrower scope than the commands actually documented. In practice, the skill also enables access to namespaces, variables, server membership, and agent information, which can expose broader cluster metadata and secrets-adjacent information than users may expect from the stated 'read-only monitoring' description.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
Allocation log retrieval can expose secrets, tokens, user data, stack traces, and other sensitive application output. Because the skill frames these commands as routine troubleshooting steps without any warning or guardrails, it increases the risk of accidental disclosure during normal use.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
Referencing NOMAD_TOKEN without guidance on secure handling encourages use of a sensitive credential without emphasizing storage, scoping, and exposure risks. In an agent or automation context, this can lead to overprivileged tokens being placed in environment variables, logs, or shared sessions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.