ClawHub
Back to skill

Security audit

Improve Codebase Architecture

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly an architecture-review helper, but it tells the agent to publish a GitHub issue without a final user review.

Review before installing. This is not malicious code, but users should require the agent to draft the RFC locally, show the target repository, title, labels, and full issue body, and only run `gh issue create` after explicit approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill’s stated purpose is architectural exploration and refactoring analysis, but it escalates into taking an external action by creating a GitHub issue. That expands scope from analysis to mutation of remote state, which can surprise the user and cause unintended repository changes under the user’s authenticated GitHub context.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Remote GitHub issue creation is not clearly necessary for an architecture-analysis skill and introduces networked side effects beyond the advertised function. In practice, this can be abused or simply misfire to create unwanted issues, leak internal architectural details to a remote repository, or operate against the wrong repo/account if CLI auth is already configured.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The instruction to run `gh issue create` omits any warning that this is an external network action that modifies remote repository state. Hidden side effects are dangerous because users may believe they are still in an analysis-only flow while the skill publishes potentially sensitive or premature design content to GitHub using existing credentials.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.