ClawHub
Back to skill

Security audit

Clawhub Daily

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed daily ClawHub recommendation tool that writes local reports and can push them to Feishu or IMA when the user provides credentials.

Install only if you want a scheduled/reporting skill that fetches ClawHub data and, when Feishu or IMA credentials are configured, sends the generated brief to those services. Use --skip-push for local-only runs, set an explicit IMA knowledge-base ID if using IMA, and keep real credentials out of any published config files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The file claims broader scanning and more outbound push channels than the implementation reportedly performs, creating a description-behavior mismatch. This is dangerous because users may grant network/filesystem/subprocess trust based on inaccurate expectations, and security reviewers cannot reliably determine what data leaves the system or which local paths are touched.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
Conflicting statements about whether shell/subprocess execution occurs weaken the trust boundary for the skill. Even if only an IMA CLI is intended, ambiguity around process execution is security-relevant because subprocess capability can expand impact to arbitrary command execution if later misused or misunderstood by hosts and users.

Scope Creep

Medium
Confidence
77% confidence
Finding
The executor relies on subprocess for the entire workflow, while the declared capability narrows subprocess use to an optional ima-skill CLI fallback. This mismatch weakens the trust boundary for users and reviewers: if the referenced scripts are modified or replaced, the executor will run them without additional restriction, creating a broader execution surface than the permission statement suggests.

Vague Triggers

Medium
Confidence
72% confidence
Finding
The manual trigger examples use broad natural-language phrases like '每日推荐' and 'ClawHub 日报' without clear scope boundaries, exclusions, or confirmation requirements. In agent environments, overly broad activation phrasing can cause accidental invocation in unrelated conversations, leading to unintended network fetches and document/message pushes if credentials are present.

Unvalidated Output Injection

High
Category
Output Handling
Content
cli_candidates = ["ima", "ima-skill", "ima_cli", "ima_push"]
    for cli in cli_candidates:
        try:
            result = subprocess.run(
                [cli, "push", "--kb-id", kb_id, "--title", title, "--content", content],
                capture_output=True, text=True, timeout=30
            )
Confidence
73% confidence
Finding
Although shell injection is avoided, the script forwards untrusted, potentially very large or adversarial content directly into an external CLI as a command-line argument. This can expose sensitive report content via process listings, trigger argument-length failures/DoS, and create unsafe downstream parsing if the third-party CLI interprets content or title values in unexpected ways.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.