ClawHub
Back to skill

Security audit

GitHub API 工具

Security checks across malware telemetry and agentic risk

Overview

This is a scoped maintainer workflow skill for ClawHub GitHub PR and issue review, with state-changing actions disclosed and aligned to that purpose.

Install this only if you want the agent to assist with ClawHub maintainer workflows and you are comfortable with it using your existing GitHub authority for comments, proof publication, labels, or close decisions. Review proposed GitHub writes before allowing them, especially merges, closures, workflow dispatches, or bulk actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill documents write-capable GitHub actions such as creating issues, merging PRs, closing issues, and dispatching workflows without explicit warnings or confirmation requirements. In an agent context, this can normalize destructive or state-changing operations and increase the likelihood of unintended modifications to repositories, workflows, or project history when a user does not fully appreciate the impact.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.