ClawHub

Curl Tool

Security checks across malware telemetry and agentic risk

Overview

This appears to be a network/file-transfer skill with expected capabilities, but its scope and credential/file-write risks are under-disclosed enough that users should review it carefully before installing.

Install only if you need a general network/request utility and are comfortable reviewing each destination and file path before use. Do not let it send secrets, auth headers, private files, or downloads unless you explicitly approve the exact URL, headers, and output location.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises and demonstrates network access and file output behavior, yet no permissions are declared to inform the platform or user of those capabilities. This creates a transparency and governance gap: a user may invoke a tool that can transmit data externally and write files without explicit permission scoping or warning.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The documentation does not accurately describe the tool's real behavior: it claims FTP support that may not exist and omits authenticated HTTP behavior. Behavior mismatches are dangerous because users and policy systems rely on the description to assess risk; omitted auth and transmission features can lead to unintended credential use or data exfiltration.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The skill is described in broad, generic terms without clear limits on when it should be invoked, what destinations are appropriate, or what data must never be sent. Overly broad invocation guidance increases the chance that an agent uses the tool in unsafe contexts, including sending sensitive data to external endpoints.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation lacks warnings that requests send data to external services, that authentication may expose credentials or tokens, and that downloads can create or overwrite local files. Missing user-facing warnings materially increase the risk of accidental data disclosure, unsafe credential handling, and unintended filesystem side effects.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal