ClawHub
Back to skill

Security audit

autonomous-loops

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly transparent, but it teaches high-impact repository automation with inconsistent safeguards around writes and auto-merge.

Review this skill carefully before installing or using it. It is appropriate only for repositories where you can enforce branch protections, least-privileged GitHub credentials, dry-run first execution, hard cost/time/run limits, and explicit human approval before every merge. Treat session files, shared notes, diffs, and CI logs as sensitive, and do not rely on the auto-merge guidance unless you have an external control that guarantees human approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The document presents contradictory safety semantics: it strongly says code must not merge without a human, but later states that human-less merge is available if explicitly enabled. In an automation skill that creates branches, pushes code, and retries CI autonomously, this ambiguity can normalize unsafe operation and lead users or downstream agents to invoke autonomous merge in situations where human approval was intended to be mandatory.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The core loop says the process stops and hands off to a human for review and merge, but later sections document `--auto-merge` behavior and show how to enable it. For an autonomous development loop, this inconsistency is dangerous because operators, wrappers, or agent planners may rely on the earlier 'STOP' guarantee while another part of the same document authorizes bypassing that control.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.