picoclaw-security-guardian

• Outcome: Pass
• Latest audit: May 28, 2026 at 7:54 AM UTC
• Version:
  0.0.3

Overview

This skill is a coherent Picoclaw security-checking tool with user-run scripts and no evidence of hidden persistence, exfiltration, or destructive behavior.

Install this only for Picoclaw security posture work. Review any --watch, --artifact, --config, and --output paths before running it because generated profiles can include paths, sizes, modes, hashes, and secret-marker counts. Treat unsigned advisory or checksum modes as temporary troubleshooting options, not normal production settings.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises a read-only/default-safe posture, but the content includes commands and workflows that require shell execution, environment access, and outbound network access without any declared permission model. This mismatch weakens operator trust boundaries because a host skill loader or reviewer may underestimate what the skill can do, increasing the chance that shell/network-capable logic is installed or run without appropriate review.

VirusTotal

61/61 vendors flagged this skill as clean.