ClawHub
Back to skill

Security audit

Module Analyzer Generate Doc

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Java module documentation generator that reads project source and writes local documentation files, with no evidence of exfiltration or destructive behavior.

Install only for projects where you are comfortable having source code and possibly configuration details summarized into local .ai-doc files. Review generated documentation for secrets before sharing it, and avoid running any package scripts unless you have inspected the script they invoke.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The guide first permits a Bash fallback with examples such as cat, wc, head, tail, and sed, then later states not to use Bash as a fallback方案. That inconsistency can cause implementers or agents to select a riskier execution path, increasing shell exposure and creating room for unsafe command construction or policy bypass under error conditions. In a documentation-generation skill that reads many user/project-controlled paths, mixed shell guidance materially raises the chance of command/path injection mistakes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.