ClawHub
Back to skill

Security audit

Validation Rules Builder

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed construction data validation helper, with local file handling that fits its purpose and no evidence of hidden exfiltration, persistence, or destructive behavior.

Install only if you are comfortable allowing the skill to work with local project data files. Keep file paths and export destinations explicit, review any generated custom validation functions before running them, and treat cost estimates or cost analysis as advisory output rather than authoritative financial results.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The schedule validator defines a date-check helper (`dates_valid`) but never registers or invokes it, so records with `start_date > end_date` will incorrectly pass validation. In a construction scheduling context, this can allow inconsistent or impossible schedule data into downstream planning, reporting, or automation workflows, undermining data integrity and potentially causing operational mistakes.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The instructions materially broaden the skill from validation-rule creation into cost estimating and cost analysis workflows, including gathering inputs and processing data via SKILL.md. This creates scope drift that can cause the agent to perform higher-risk financial or business-analysis actions the skill was not declared to handle, increasing the chance of misuse, over-collection of data, or unsafe downstream behavior.

Description-Behavior Mismatch

Low
Confidence
79% confidence
Finding
The output requirements instruct the agent to provide summary statistics, key findings, and export options, which go beyond narrow validation-rule generation and nudge the skill toward broader analytics behavior. While not directly dangerous on its own, this expansion can compound the earlier scope mismatch and encourage handling or transforming user data in ways not clearly covered by the skill definition.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.