ClawHub
Back to skill

Security audit

Run

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only execution skill that broadly encourages arbitrary code execution, scheduled automation, and production deployment without clear controls.

Review before installing. Use only with a separately enforced sandbox and explicit human approval for code execution, dependency installation, network access, filesystem writes, scheduled jobs, secrets use, and any production deployment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrase "Run this script" is overly generic and likely to overlap with ordinary user requests, which increases the chance of accidental or unauthorized invocation of a highly privileged execution capability. In a skill whose purpose is arbitrary code execution, broad natural-language triggers materially raise the risk of prompt-triggered misuse or unintended activation.

Vague Triggers

High
Confidence
96% confidence
Finding
The trigger "Run this in production" is ambiguous, high-impact, and directly tied to deployment behavior, making accidental activation especially dangerous. A common-language phrase that can initiate production deployment creates substantial risk of unintended changes, service disruption, or abuse if the agent interprets user text too broadly.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.