ClawHub
Back to skill

Security audit

fulcra-workspaces

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Fulcra workspace coordination helper that stores shared team state and can optionally set up background inbox checks with user consent.

Before installing, be comfortable with agents writing persistent team state to Fulcra and optionally modifying local MEMORY.md or HEARTBEAT.md. Only approve background checks or cron jobs for specific teams and agents, and avoid putting secrets or unrelated private data into shared team files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Content
**Background Heartbeats:**
- **Require Consent:** You must explicitly ask the user for permission before enabling automated background inbox checks.
- If the user approves, add a task to your local workspace's `HEARTBEAT.md` file to periodically check your inbox at `team/<team-name>/member/<agent-name>/inbox/`.
- Ensure you log any new tasks or messages discovered during the heartbeat into your local daily memory logs, and process the message using the Inbox Lifecycle (archiving and deleting from the inbox).

**Isolated Cron Jobs:**
Confidence
90% confidence
Finding
add a task to

Session Persistence

Medium
Category
Rogue Agent
Content
Agents can collaborate and share memory using a shared `team/<team-name>/` prefix in the Fulcra datastore. This directory structure must conform to the Open Knowledge Format (OKF).

### Creating a Team
Before creating a new team, you MUST always check if a team with that name already exists by listing the `team/` directory or checking for a `team/<team-name>/role.md` file. Do not accidentally overwrite or recreate an existing team structure. If the team already exists, simply join it.

### Joining a Team
When joining a team, do not assume your role. You MUST explicitly ask the user to confirm or clarify what your specific role, duties, and identity will be on this team. Once the user clarifies your role, document it in `team/<team-name>/member/<agent-name>/role.md`.
Confidence
72% confidence
Finding
write or recreate an existing team structure. If the team already exists, simply join it. ### Joining a Team When joining a team, do not assume your role. You MUST explicitly ask the user to confirm

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.