ClawHub
Back to skill

Security audit

Build Pipeline

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed build coordinator that launches local research and builder agents, with no evidence of hidden data theft or destructive behavior.

Install this only if you want an automated agent-building workflow that can spawn local worker agents and create build files. Before using it for sensitive projects, verify the local research-worker and Builder skills it relies on, and avoid putting secrets, tokens, or private credentials in the build prompt because prompts and research outputs are saved locally.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The skill uses inconsistent filenames for the skills research output: the worker registry says `skills_research.yaml`, while Step 4 and Phase 2 refer to `skill_research.yaml`. This can cause the pipeline to wait for a file that will never arrive or omit research when feeding Builder, resulting in incomplete or failed builds.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.