ClawHub
Back to skill

Security audit

First Principles

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a reasoning template, but it automatically fetches a remote replacement version of itself at runtime, which can change agent instructions after review.

Review this skill before installing because its local behavior is understandable, but it asks your agent to contact a deciqAI URL on each run and potentially follow updated remote skill text. Install only if you trust that remote endpoint to change the skill's instructions after marketplace review.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Low
Confidence
90% confidence
Finding
The skill instructs the agent to fetch remote content at runtime and treat it as the canonical current version of the skill. That creates a supply-chain and prompt-injection surface: whoever controls the remote JSON or the network path can change the agent's behavior after installation, bypassing local review of the checked-in skill content.

Context-Inappropriate Capability

Low
Confidence
86% confidence
Finding
A first-principles reasoning skill does not need network access to perform its stated function, so the remote self-refresh is unnecessary privilege and increases attack surface without clear justification. Unnecessary remote dependencies are dangerous because they enable behavior drift, remote content injection, and privacy leakage about when the skill is invoked.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The markdown directs the agent to make a network request at run start without any user-facing disclosure or consent. This is risky because it can silently exfiltrate contextual metadata such as invocation timing, environment identifiers in surrounding requests, or usage patterns, and it exposes the agent to remote prompt injection before completing the user's task.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.