ClawHub
Back to skill

Security audit

Uuid Generator Tool

Security checks across malware telemetry and agentic risk

Overview

This is a simple local UUID utility, with a privacy caveat that UUID v1 values can reveal time and device-related metadata.

This skill is reasonable to install for local UUID generation. Prefer UUID v4 for public, shared, or privacy-sensitive identifiers; only use UUID v1 when you specifically want time-based IDs and accept that they may reveal timestamp and machine-related metadata. Do not provide credentials to this skill, because the reviewed artifacts do not need them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation promotes UUID v1 generation while only briefly noting it is time-based, but does not clearly warn that v1 UUIDs can encode host-identifying information such as the MAC address and creation time. In a utility intended for general-purpose identifier generation, this can lead users to unintentionally expose device metadata or generate trackable identifiers in logs, URLs, or shared datasets.

Missing User Warnings

Low
Confidence
91% confidence
Finding
The tool exposes UUID v1 generation without warning users that v1 values encode timestamp information and may expose node-identifying data such as a MAC-derived identifier. In a general-purpose UUID utility, this can lead users to select v1 for identifiers that are later shared externally, creating avoidable privacy and metadata-leakage risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.