ClawHub
Back to skill

Security audit

Network Toolbox

Security checks across malware telemetry and agentic risk

Overview

This is a coherent network diagnostics skill, but users should review it because it can probe remote systems and silently disables HTTPS certificate validation in security-related checks.

Install only if you intend to run user-directed network diagnostics. Use it only on hosts you own or are authorized to test, treat public-IP lookup as sharing your source IP with external services, and do not rely on its HTTPS or SSL output for trust decisions unless certificate validation is fixed or explicitly marked as insecure.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The default non-redirect path explicitly disables TLS certificate verification and hostname checking, which allows man-in-the-middle interception or spoofing of HTTPS endpoints. This is especially problematic because the tool presents itself as a normal HTTP inspection utility, so users are likely to assume standard HTTPS validation is still being enforced.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly supports port scanning, public IP discovery, HTTP inspection, and other network-enumeration actions, but it does not warn users that these operations may be sensitive, logged, unauthorized on third-party systems, or privacy-impacting. In an agent setting, this omission increases the risk that users invoke potentially intrusive recon behavior without understanding legal, ethical, or data-exposure implications.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/net_http.py:16

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/net_ssl.py:8