ClawHub
Back to skill

Security audit

Clawhub Skill Optimizer

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only ClawHub skill optimization guide with disclosed example API code, not an installed program that runs by itself.

Safe to install as an advisory/reference skill. Do not copy-run the Python trend-tracking snippets or background-worker example without reviewing the outbound services, data sent, request frequency, and platform rules; keep metadata edits and social posts under manual approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

High
Confidence
96% confidence
Finding
The skill claims there is no executable code or network activity, but later embeds runnable Python that performs HTTP requests to third-party services. This mismatch can mislead users and downstream agents into treating the skill as safer than it is, reducing scrutiny around code snippets that transmit data externally.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The document states it will not automatically call external APIs, yet it provides concrete API-calling guidance elsewhere in the skill. Even if not auto-executed, contradictory assurances can cause users or toolchains to trust the content and manually or programmatically adopt unsafe network behavior without proper review.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The alert/reporting sections describe periodic aggregation of trending data from multiple third-party services, but do not disclose that repeated outbound requests will be made or that user-supplied keywords/tags may be sent to external providers. In a skill context, this can create privacy, compliance, and network-governance issues because operators may unknowingly transmit metadata about their skills or interests to external services on a schedule.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.