ClawHub
Back to skill

Security audit

炽风

Security checks across malware telemetry and agentic risk

Overview

This fan-control skill has a coherent purpose, but it teaches root-level trial writes to low-level hardware controls and persistent overrides without enough safety guardrails.

Install only if you are comfortable with low-level Linux hardware control. Use read-only detection and vendor-supported tools first, avoid trial EC writes unless you have device-specific validation and recovery access, monitor temperatures continuously, and do not enable autostart until the configuration has been safely tested.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs direct writes to sysfs PWM controls to change fan speed but does not warn about the risk of stopping or under-driving cooling, which can cause overheating, instability, or hardware damage. In this context the commands are operationally powerful and safety-critical, so omission of explicit thermal safeguards makes the guidance unsafe.

Missing User Warnings

High
Confidence
99% confidence
Finding
The skill recommends trial writes to EC registers discovered via diffing, which is a hazardous low-level hardware operation with root privileges and no strong warning about possible hangs, firmware state corruption, fan disablement, or thermal runaway. Because EC register layouts are undocumented and device-specific, blind writes can affect unrelated functions and create immediate system-integrity risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advises deploying a persistent control loop and systemd autostart to continuously override EC/firmware fan policy, but does not warn that this can defeat thermal safety logic or persist unsafe settings across reboots. Persistence increases danger because a bad configuration can keep reapplying automatically even when the system is unattended.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
sudo hexdump -C /sys/kernel/debug/ec/ec0/io 2>/dev/null

# 监控 EC 寄存器变化
sudo watch -t -n 0.5 'xxd -s 0xC0 -l 32 /sys/kernel/debug/ec/ec0/io' 2>/dev/null

# 写 EC 寄存器（试错法）
echo -n -e '\x80' | sudo dd of=/sys/kernel/debug/ec/ec0/io bs=1 seek=0xCE 2>/dev/null
Confidence
97% confidence
Finding
sudo

Chaining Abuse

High
Category
Tool Misuse
Content
sudo watch -t -n 0.5 'xxd -s 0xC0 -l 32 /sys/kernel/debug/ec/ec0/io' 2>/dev/null

# 写 EC 寄存器（试错法）
echo -n -e '\x80' | sudo dd of=/sys/kernel/debug/ec/ec0/io bs=1 seek=0xCE 2>/dev/null

# 全量差分
sudo xxd /sys/kernel/debug/ec/ec0/io > /tmp/ec_before
Confidence
90% confidence
Finding
| sudo

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.