ClawCompany

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.0

Overview

ClawCompany is a disclosed AI coding workflow, but it should be reviewed because it can automatically edit project files and may expose API/session details in logs.

Install only if you want a multi-agent coding tool that can modify a project. Use it in a clean repo or branch, prefer dry-run first, keep verbose logs private, do not paste secrets into requests, and manually inspect diffs instead of relying on the built-in review approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill documents use of environment variables such as GLM_API_KEY but does not declare corresponding permissions or clearly constrain access to sensitive runtime capabilities. This can lead to unexpected secret exposure or capability expansion, especially because the skill spawns other agents and forwards prompts/data across runtimes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared description presents the skill as a collaboration/workflow helper, but the documented behavior includes external session orchestration, history retrieval, environment-variable usage, and effectively project-generation execution. This mismatch undermines user consent and review, because a user invoking a generic development helper may not expect external API calls, credential use, or repository-affecting automation.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The Dev Agent claims to implement tasks and create files, but the function does not inspect agent output or verify which files were actually written. This creates a misleading trust boundary: downstream review and reporting operate on fabricated filenames, which can hide unexpected file writes or cause security review to miss real modified files.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: If the Review Agent returns malformed JSON or any unparsable response, the code defaults to approval. That means the security gate can be bypassed by agent failure, prompt injection, model drift, or output truncation, allowing unsafe code to be treated as reviewed.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README states the skill is automatically invoked for broad requests like creating or building features, which can cause the skill to trigger on common prompts and begin autonomous code-generation workflows without clear user confirmation. In this skill's context, that is more dangerous because the documented workflow includes generating and saving files via a Dev Agent, increasing the risk of unintended project modification.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README describes the Dev Agent as generating code and saving files but does not warn users that running the skill may modify project contents. In an automated multi-agent coding skill, lack of a prominent file-modification warning can lead to unintended overwrites, unsafe edits, or trust in AI-generated changes without review.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are extremely broad (e.g. create/build/implement/develop) and likely to match many ordinary requests, causing the skill to activate in situations where the user did not intend autonomous multi-agent code generation. Over-broad activation increases the chance of surprise actions, unnecessary external calls, and unintended repository changes.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The usage guidance says the skill should run whenever users ask to create or implement something, which is too ambiguous for a tool that can spawn agents and generate files. Ambiguous activation makes accidental execution more likely and reduces informed user consent for external processing and code changes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises automatic code generation and file creation but does not warn users that repository contents may be modified or new files may be produced. In a development environment, this can lead to unreviewed changes, overwrites, or insertion of insecure code generated by subagents.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The PM agent prompt interpolates raw userRequest and sends it to an external/subagent session via sessions_spawn without any notice, consent, or data-minimization step. This creates a real privacy and prompt-injection exposure because sensitive user content may be transmitted off-process or to a different trust boundary unexpectedly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill invokes a Dev agent in the target cwd/projectPath with instructions to implement functionality and create files, but does not present a clear warning or require confirmation before modifying the filesystem. In this skill's context, the whole purpose is automated software generation, so silent file creation in the current working directory materially increases the risk of unintended code changes, overwrites, or placement of unsafe generated artifacts.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:30