ClawHub
Back to skill

Security audit

FTTR Copilot

Security checks across malware telemetry and agentic risk

Overview

This is a coherent FTTR Copilot integration, but it handles sensitive customer device data and should be used only with trusted tokens and endpoints.

Install only if you trust the publisher and need FTTR Copilot access. Treat FTTRAI_AUTH_TOKEN as a sensitive credential, avoid sharing logs or screenshots containing outputs, keep FTTRAI_RPC_URL on a trusted HTTPS endpoint, and confirm the exact device before alias updates or real-time commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Low
Confidence
87% confidence
Finding
The README instructs users to supply a customer bearer token for FTTRAI APIs but provides no warning about treating that token as sensitive, avoiding logging or screenshots, or understanding the privacy implications of querying customer device and network data. In a skill that performs cloud device lookup, diagnostics, and operational commands, this omission increases the chance of accidental credential disclosure or mishandling of customer data.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The tool returns the entire backend response in `data.raw` while also surfacing device identifiers such as MAC address, serial number, and device IDs. In a cloud-control/diagnostics skill, this creates unnecessary overexposure of potentially sensitive operational data to downstream consumers, logs, or users who only requested alert summaries, increasing privacy and reconnaissance risk.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This code issues a remote device command through ExecuteCMD based on a resolved device identifier, but nothing in this path enforces user confirmation, authorization checks, or even a user-visible disclosure that an active command is being sent to managed equipment. In an FTTR/cloud-control skill, command execution is inherently security-sensitive because it can affect real customer network devices; relying on surrounding layers to warn or gate the action is risky unless those controls are explicit and guaranteed.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
getDeviceLoad includes `raw: detailResult.data.raw` in the returned payload, which can expose the full backend response beyond the curated fields. If that raw object contains account identifiers, tokens, internal fields, or unsupported sensitive metadata, downstream consumers may receive unnecessary sensitive data and the attack surface for accidental disclosure increases.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.