ClawHub
Back to skill

Security audit

Guardrails

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent guardrails purpose, but it can collect sensitive workspace and memory context and send workspace-derived data to OpenAI or Anthropic without a clear pre-send consent or redaction step.

Install only if you are comfortable with workspace metadata, selected file contents, memory-log matches, and interview answers being stored locally and potentially sent to OpenAI or Anthropic. Avoid entering secrets, review guardrails-config.json after setup, and run it only in workspaces where third-party LLM processing is allowed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Intent-Code Divergence

Low
Confidence
83% confidence
Finding
The integration discovery logic does not merely check for tool presence; it executes each discovered binary with --version. In an adversarial or untrusted PATH environment, a trojaned binary named git, gh, docker, or similar could run arbitrary code during discovery, turning passive inspection into command execution.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script reads previews of multiple workspace files and includes their contents in emitted JSON without any consent, masking, or warning. Those files may contain secrets, policies, internal instructions, or personal data that could be exposed to downstream consumers of the JSON.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script reads and outputs the full contents of existing GUARDRAILS.md and guardrails-config.json. Full-file exfiltration is riskier than small previews because configuration files can contain sensitive operational rules, endpoints, tokens, or internal security logic, and this data is serialized directly to stdout for downstream use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script serializes and sends the full discovery, classification, and interview answers to a third-party LLM provider, and the answers may contain sensitive personal or organizational data. Because transmission is automatic once API keys are present and there is no consent gate, redaction step, or provider allowlist at the call site, this creates a real data-exfiltration/privacy risk rather than a mere theoretical network use.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script sends workspace discovery and risk-classification content to a third-party LLM provider, which can include sensitive information about installed skills, integrations, communication channels, and risk posture. Although this appears to be the feature's intended behavior rather than covert exfiltration, there is no explicit consent gate, redaction step, or prominent warning at the point data leaves the boundary, so users may unknowingly disclose internal metadata externally.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script reads matching lines from recent memory markdown files and includes that raw context directly in the JSON report. Memory logs can contain secrets, personal data, prompts, or incident details, so returning those contents to any caller of the monitor command creates an unnecessary data exposure channel even if the script is only intended for guardrail monitoring.

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_openai(api_key, model, system_prompt, user_message, timeout=90):
    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {api_key}",
Confidence
88% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_anthropic(api_key, model, system_prompt, user_message, timeout=90):
    resp = requests.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,
Confidence
88% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_openai(api_key, model, system_prompt, user_message, timeout=90):
    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {api_key}",
Confidence
88% confidence
Finding
requests.post( "https://api.openai.com/v1/chat/completions", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", },

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_anthropic(api_key, model, system_prompt, user_message, timeout=90):
    resp = requests.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,
Confidence
88% confidence
Finding
requests.post( "https://api.anthropic.com/v1/messages", headers={ "x-api-key": api_key, "Content-Type": "application/json", "anthropic-version": "20

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_openai(api_key, model, system_prompt, user_message, timeout=60):
    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {api_key}",
Confidence
80% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_anthropic(api_key, model, system_prompt, user_message, timeout=60):
    resp = requests.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,
Confidence
80% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_openai(api_key, model, system_prompt, user_message, timeout=60):
    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {api_key}",
Confidence
80% confidence
Finding
requests.post( "https://api.openai.com/v1/chat/completions", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", },

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_anthropic(api_key, model, system_prompt, user_message, timeout=60):
    resp = requests.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,
Confidence
80% confidence
Finding
requests.post( "https://api.anthropic.com/v1/messages", headers={ "x-api-key": api_key, "Content-Type": "application/json", "anthropic-version": "20

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_openai(api_key, model, system_prompt, user_message, timeout=60):
    resp = requests.post(
        "https://api.openai.com/v1/chat/completions",
        headers={
            "Authorization": f"Bearer {api_key}",
            "Content-Type": "application/json",
Confidence
77% confidence
Finding
https://api.openai.com/

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_anthropic(api_key, model, system_prompt, user_message, timeout=60):
    resp = requests.post(
        "https://api.anthropic.com/v1/messages",
        headers={
            "x-api-key": api_key,
            "Content-Type": "application/json",
Confidence
77% confidence
Finding
https://api.anthropic.com/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.