ClawHub
Back to skill

Security audit

Random Tool

Security checks across malware telemetry and agentic risk

Overview

This local random generator is not malware, but it needs review because it advertises secure passwords and tokens while using non-secure randomness.

Install only if you will use it for testing data or non-security randomization. Do not use it to generate real passwords, API keys, recovery codes, security tokens, or credentials unless it is updated to use a cryptographically secure generator such as Python's secrets module and the documentation is corrected.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
99% confidence
Finding
The function docstring explicitly claims to generate a secure password, but it uses Python's random module, which is not cryptographically secure and can be predictable in security-sensitive contexts. Because this skill is marketed for passwords and security tokens, users may rely on this output for real secrets, increasing the likelihood of weak credential or token generation.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
Password generation with the non-cryptographic random module is unsafe when the tool implies security usage, because outputs may be predictable enough for attackers to reduce brute-force effort or reconstruct generated secrets under some conditions. The surrounding skill description explicitly mentions security tokens, which makes this more dangerous than a toy randomizer because it invites high-risk use cases.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.