ClawHub
Back to skill

Security audit

Services Watchdog

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a legitimate watchdog helper, but its included script is personalized and can use a local Telegram bot token to send status messages to a hard-coded chat without clear user control.

Review and modify this before installing. Remove or explicitly configure the Telegram notification block, replace all hard-coded service paths and chat IDs, create and inspect the missing systemd unit files yourself, and make sure you know how to disable the user timer and loginctl linger.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
A description-behavior mismatch is dangerous because users and orchestrators may grant trust based on the advertised purpose while the underlying implementation performs materially different actions, including handling credentials and targeting specific services. The static finding indicates hidden service-specific behavior and Telegram messaging that are not disclosed here, which would expand the attack surface and could enable unauthorized monitoring, exfiltration, or persistence under misleading cover.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script reads a Telegram bot token from another project's .env file and uses it to send external notifications. This introduces credential reuse across project boundaries and transmits operational state to a third party without the watchdog's stated purpose requiring such access, increasing the blast radius if the script is modified or abused.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script silently accesses a bot token and sends service status externally to Telegram, which is a data disclosure behavior not obvious from a watchdog script. Hidden outbound notifications reduce operator awareness and can leak environment structure, failures, and service names to external infrastructure.

Session Persistence

Medium
Category
Rogue Agent
Content
chmod +x "$WORKSPACE/scripts/services-watchdog.sh"

systemctl --user daemon-reload
systemctl --user enable --now sahi-watchdog.timer
loginctl enable-linger "$USER"   # keeps the timer running when not logged in
```
Confidence
95% confidence
Finding
systemctl --user enable

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.