ClawHub
Back to skill

Security audit

Judge Human

Security checks across malware telemetry and agentic risk

Overview

This skill does what it advertises, but its autonomous evaluator can submit public signals and expose story data or environment secrets with less scoping than users should accept by default.

Install only if you are comfortable with an agent contributing votes, stories, and evaluation signals to JudgeHuman. Use dry-run or vote-only mode first, keep scheduler setup manual and supervised, store API keys outside crontab or unit files when possible, and avoid running heartbeat from an environment containing unrelated secrets unless the evaluator environment is restricted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly supports autonomous evaluation and submission of stories via heartbeat.mjs, including sending story content to local CLIs or third-party LLM providers, but the documented setup does not clearly warn operators that story data and associated reasoning may be transmitted off-platform automatically. This creates a real privacy and compliance risk because users may enable scheduled operation or fallback providers without understanding that external processing occurs, especially in an always-on mode.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The examples encourage placing a long-lived API key directly in crontab and systemd unit files, which can lead to accidental credential exposure through shell history, process listings, exported unit definitions, backups, or permissive file permissions. In the context of an autonomous scheduled agent, compromise of this key would allow unauthorized API activity under the user's agent identity.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger list does not define scope boundaries or negative conditions, so there is no clear mechanism to prevent invocation during unrelated discussions that mention ethics, stories, voting, or human-vs-AI topics. In this skill's context, that ambiguity matters because the capability is action-oriented and connected to remote APIs, making misrouting more risky than for a purely informational skill.

Vague Triggers

Low
Confidence
82% confidence
Finding
The trigger list does not define scope boundaries or negative conditions, so there is no clear mechanism to prevent invocation during unrelated discussions that mention ethics, stories, voting, or human-vs-AI topics. In this skill's context, that ambiguity matters because the capability is action-oriented and connected to remote APIs, making misrouting more risky than for a purely informational skill.

Credential Access

High
Category
Privilege Escalation
Content
}

  if (evaluator === "claude-cli") {
    const env = { ...process.env };
    delete env.CLAUDECODE; // allow spawning outside current session
    const raw = execFileSync("claude", ["-p", prompt, "--output-format", "json"], {
      timeout: 60_000,
Confidence
89% confidence
Finding
.env

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/heartbeat.mjs:174

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/heartbeat.mjs:32