ClawHub
Back to skill

Security audit

agentdots-sync

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Git-based sync tool for selected local agent instruction files, with safeguards before it writes or pushes changes.

Install only if you want an agent to help synchronize selected local agent configuration, rules, or skills with a Git remote. Review the generated plan carefully before approving any `--yes` command, especially when applying from or pushing to a remote repository.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read and write local files and execute Python commands, but no explicit permission model is declared in the skill metadata. That creates a real security gap because a caller or orchestrator may invoke a capability-bearing skill without clear guardrails, increasing the risk of unauthorized filesystem changes or shell execution if the skill is triggered unexpectedly or used in a weakly mediated environment.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The description uses broad trigger phrases such as 'sync, restore, apply, back up, push, or roll back local agent instructions' across multiple platforms, which makes accidental invocation more likely. Because this skill can lead to shell execution and local file mutation, an overly broad invocation surface materially increases the chance that the skill runs in contexts the user did not specifically intend.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.