ClawHub
Back to skill

Security audit

Trending Skill Finder

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local ClawHub trend monitor that fetches public skill metrics and stores local state for alerts.

Install it if you want a local ClawHub trend checker. Expect it to contact clawhub.ai, create files under ~/.skill-surge-notifier unless you override paths, and append logs if you add the cron example. Avoid storing secrets in the profile description or custom config paths.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation describes capabilities that use network access and environment-controlled paths, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: an agent or reviewer may authorize the skill under incomplete assumptions while it still performs external fetches and reads behavior from environment variables.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
fetch_trending.js:21