ClawHub
Back to skill

Security audit

Update Docs

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-update helper whose repository reads, git diffs, and documentation edits fit its stated purpose, with no hidden install hook, network exfiltration, persistence, or destructive behavior found.

Before installing, be aware that this skill is meant to inspect repository changes and modify documentation files. Use it only in repositories where you are comfortable granting git and file access, review proposed edits before approval, and consider adding explicit permission metadata if publishing or maintaining the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill instructs the agent to run shell commands (`git diff ...`) and to read and modify documentation files, but it declares no permissions. This creates a trust and enforcement gap: callers or policy engines may treat the skill as low-risk while it actually requires shell, file read, and file write capabilities, increasing the chance of unintended repository access or modification.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.