ClawHub
Back to skill

Security audit

Repo Security Auditor

Security checks across malware telemetry and agentic risk

Overview

This appears to be a repository-auditing skill whose cloning and report-writing behavior fits its purpose, but users should understand it will download untrusted code and leave audit artifacts on disk.

Install only if you are comfortable with the skill downloading repositories you ask it to audit and saving reports locally. Prefer running it in a disposable or project-specific workspace, do not execute code from cloned repositories unless you separately trust it, and periodically clean up retained audit artifacts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs cloning arbitrary third-party repositories, which causes network access and filesystem writes, but it does not clearly warn the user about those side effects first. In an agent setting, this can lead to unanticipated retrieval of untrusted content and local persistence of potentially sensitive or harmful material, especially if users expected analysis-only behavior.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill mandates saving reports and scaffolds to a fixed path in the user's home directory without prominently disclosing that it will create files and directories. This can surprise users, overwrite or clutter local storage, and create privacy or retention issues by persisting analysis artifacts derived from untrusted repositories.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.