ClawHub

Dispatchi (Ralph Loop)

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its dispatcher purpose, but it should be reviewed because it starts background Claude sessions while auto-accepting safety prompts and using weakly validated user-controlled paths and prompts.

Install only if you are comfortable with a skill that starts background Claude Code sessions in local repositories. Use simple safe project and task names, avoid bypassPermissions or broad permission modes, keep callbacks disabled unless needed, and prefer a version that validates paths, fixes shell quoting, and stops auto-accepting Claude safety prompts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
claude_parts += args.extra

    launch = f"cd {shlex.quote(cwd)} && " + " ".join(shlex.quote(p) for p in claude_parts)
    subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", launch))
    subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"))

    # Workspace trust prompt (first run in a new folder).
Confidence
94% confidence
Finding
subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", launch))

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Workspace trust prompt (first run in a new folder).
    if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=20):
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
        if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=2):
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)
Confidence
97% confidence
Finding
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# If we send task text before accepting this prompt, it can accidentally choose the default "No, exit".
    if tmux_wait_for_text(socket_path, target, "Yes, I accept", timeout_s=10):
        # Select option 2 and confirm.
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "2"), check=False)
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
Confidence
99% confidence
Finding
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "2"), check=False)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
        if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=2):
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)

    # Bypass Permissions warning prompt (when running with --permission-mode bypassPermissions).
Confidence
97% confidence
Finding
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if args.prompt:
        for line in [ln for ln in args.prompt.splitlines() if ln.strip()]:
            subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", line))
            subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"))
            time.sleep(args.interactive_send_delay_ms / 1000.0)
Confidence
93% confidence
Finding
subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", line))

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.check_call (code execution)

Medium
Category
Data Flow
Content
claude_parts += args.extra

    launch = f"cd {shlex.quote(cwd)} && " + " ".join(shlex.quote(p) for p in claude_parts)
    subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", launch))
    subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"))

    # Workspace trust prompt (first run in a new folder).
Confidence
95% confidence
Finding
subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", launch))

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
# Workspace trust prompt (first run in a new folder).
    if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=20):
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
        if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=2):
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)
Confidence
97% confidence
Finding
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
# If we send task text before accepting this prompt, it can accidentally choose the default "No, exit".
    if tmux_wait_for_text(socket_path, target, "Yes, I accept", timeout_s=10):
        # Select option 2 and confirm.
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "2"), check=False)
        subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
Confidence
98% confidence
Finding
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "2"), check=False)

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)
        time.sleep(0.8)
        if tmux_wait_for_text(socket_path, target, "Yes, I trust this folder", timeout_s=2):
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)
            subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"), check=False)

    # Bypass Permissions warning prompt (when running with --permission-mode bypassPermissions).
Confidence
97% confidence
Finding
subprocess.run(tmux_cmd(socket_path, "send-keys", "-t", target, "1"), check=False)

Tainted flow: 'socket_path' from os.environ.get (line 187, credential/environment) → subprocess.check_call (code execution)

Medium
Category
Data Flow
Content
if args.prompt:
        for line in [ln for ln in args.prompt.splitlines() if ln.strip()]:
            subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", line))
            subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "Enter"))
            time.sleep(args.interactive_send_delay_ms / 1000.0)
Confidence
95% confidence
Finding
subprocess.check_call(tmux_cmd(socket_path, "send-keys", "-t", target, "-l", "--", line))

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares that it runs a local shell script with user-supplied arguments and uses environment-driven configuration, but it does not declare permissions for shell or environment access. That mismatch reduces transparency and weakens policy enforcement, making it easier for a caller to invoke filesystem, tmux, and process-launch capabilities without an explicit permission boundary.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal