ClawHub
Back to skill

Security audit

SSL Certificate Checker

Security checks across malware telemetry and agentic risk

Overview

This appears to be a disclosed security-scanning skill whose local reads, network lookups, and optional report outputs fit its stated purpose, with one documentation inconsistency around file writes.

Safe to install if you want a local security scanner, but treat it as sensitive: it may inspect agent/MCP configuration paths and can write report files when you request outputs. Review the generated reports before sharing them, and prefer explicit output paths in a dedicated reports directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation indicates the tool can generate HTML reports and write them to disk, which is a file-write capability, yet no permissions are declared. Undeclared write access is risky because agents or operators may invoke the skill assuming it is read-only/network-only, while it can modify the local filesystem and potentially overwrite files if output paths are user-controlled.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.