ClawHub
Back to skill

Security audit

Cc Plugin

Security checks across malware telemetry and agentic risk

Overview

This is a coherent plugin-management skill, but it gives guidance and helper scripts that can persistently change local Claude Code plugin state and run plugin build code, so it belongs in Review.

Install only if you intend to let the skill manage local Claude Code plugin state. Use dry-run paths first, review backups before enabling plugins, run cache sync only for trusted marketplace content, and inspect package.json/lockfiles before following any npm install or build instruction.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill advertises operational plugin lifecycle tasks that imply shell/file-system actions, but it does not declare permissions accordingly. Undeclared shell capability weakens user visibility and review, increasing the chance that file edits or command execution occur without clear consent boundaries.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The documented purpose sounds like general plugin management guidance, but the underlying behavior includes modifying ~/.claude/settings.json, editing marketplace metadata, copying plugin components, and changing script executability. Those are security-relevant state changes that can persistently alter the local plugin environment and enable code to run, so under-describing them materially increases risk.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger list is broad and includes common phrases such as 'plugin error', 'load error', and 'statusline', which can cause the skill to activate in contexts the user did not intend. Because this skill appears capable of performing shell-backed plugin management actions, accidental invocation raises the chance of unnecessary or unsafe filesystem and configuration changes.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The manual fallback provides copy-paste commands that directly modify `~/.claude/settings.json` and the marketplace clone metadata under `~/.claude/plugins/...` using temporary files in `/tmp`, but it does not place a prominent safety warning immediately adjacent to those commands. In a skill whose purpose is to alter plugin activation and marketplace content, this is operationally risky because users may run the commands without understanding they are mutating persistent local agent configuration and test environment state.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The troubleshooting guide instructs users to run `npm install && npm run build` inside a plugin cache directory without any warning that these commands execute arbitrary third-party package scripts and build code. In the context of plugins sourced from marketplaces, this can lead to execution of untrusted code on the user's machine during troubleshooting, expanding impact beyond passive diagnosis into active code execution.

Agent Config Directory Access

High
Category
Agent Snooping
Content
# 4. Optional: enable plugin in settings.json
if [ -n "$ENABLE" ]; then
  S="$HOME/.claude/settings.json"
  KEY="$ENABLE@$MARKETPLACE"
  if [ "$DRYRUN" = 1 ]; then
    echo "DRY: enable $KEY in $S (with backup)"
Confidence
95% confidence
Finding
/.claude/settings.json

Session Persistence

Medium
Category
Rogue Agent
Content
MARKET=~/.claude/plugins/marketplaces/<marketplace>/plugins/<plugin-name>
CACHE=~/.claude/plugins/cache/<marketplace>/<plugin-name>/<version>

mkdir -p "$CACHE"

# Copy essential directories
for item in .claude-plugin .mcp.json agents CLAUDE.md dist hooks scripts skills; do
Confidence
90% confidence
Finding
mkdir -p "$CACHE" # Copy essential directories for item in .claude-plugin .mcp.json agents CLAUDE.md dist hooks scripts skills; do [ -e "$MARKET/$item" ] && cp -r "$MARKET/$item" "$CACHE/" done ```

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.