ClawHub
Back to skill

Security audit

AI SkillHub

Security checks across malware telemetry and agentic risk

Overview

This skill openly automates content extraction and GitHub publishing, but it can publish full raw content using local credentials without a clear approval step.

Review before installing. Use only a dedicated private repository and least-privilege GitHub token, inspect the referenced local scripts first, avoid sensitive or copyrighted sources, and manually review generated files and the git diff before allowing any push.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly reads GitHub credentials from a local secrets file and uses them to clone and push content to a remote repository, but nowhere requires informed user consent or warns that extracted content will be published externally. In this context, the workflow handles arbitrary web content and user-pasted transcripts, so silent publication can expose sensitive, copyrighted, or private material and also normalize credential use without approval.

Ssd 3

High
Confidence
99% confidence
Finding
The skill requires saving the complete source content '一字不删' and later publishing it, creating a direct data leakage path for any sensitive, private, or copyrighted material collected from websites or pasted by the user. Because the instruction forbids omission or truncation, the agent is pushed toward maximal retention and disclosure instead of data minimization.

Ssd 3

Medium
Confidence
90% confidence
Finding
The fallback directs the user to paste full transcript/article contents back into the system, after which the workflow continues processing and later stores or publishes that material. This increases the risk of collecting sensitive or proprietary user-supplied content without clear boundaries or disclosure controls.

Ssd 3

High
Confidence
99% confidence
Finding
This workflow pushes stored raw content and generated summaries to GitHub, which is an external destination and may be public or broadly accessible depending on repository settings. Given the earlier steps collect arbitrary web content and user-pasted material, this creates a strong exfiltration and compliance risk, especially for private, sensitive, or copyrighted data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.