ClawHub
Back to skill

Security audit

Skill Trend Analysis

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed read-only trend analysis skill that calls a specific external API and does not show credential access, persistence, or destructive behavior.

Install if you are comfortable sending ClawHub skill search and trend queries to the disclosed third-party API. Avoid placing sensitive text in search parameters, and prefer a trusted HTTPS endpoint via BASE_URL if confidentiality matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to run shell commands such as curl, jq, and bash scripts, but it does not declare any corresponding permissions or execution boundaries. This creates a capability mismatch where a reviewer or runtime may underestimate the skill's ability to perform network access and command execution, increasing the chance of unsafe execution against attacker-influenced inputs.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.