ClawHub
Back to skill

Security audit

TinkerClaw Token Efficiency Guide

Security checks across malware telemetry and agentic risk

Overview

This is a token-efficiency guide with disclosed manual configuration and cron suggestions; it has some data-loss risks if followed blindly, but no hidden execution or malicious behavior was found.

Before installing or following the guide, review any cron jobs and deletion commands carefully. Treat the maintenance scripts as examples: test them first, confirm the session paths are correct, back up anything needed for audit or recovery, and avoid automatic resets until active work is checkpointed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The guide recommends unattended cron scripts that archive and delete session files, including permanent deletion of archives older than 30 days, without warning about retention policies, recovery limits, or the risk of deleting active or needed data. In an agent skill context, operational advice that automates file movement and deletion can cause silent data loss and disrupt audits, debugging, or recovery if users apply it blindly.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The guide advises automatic session resets and manual resets after major tasks as a token-saving measure, but does not warn that active context, task state, or unsaved work may be lost. In this context, the recommendation directly affects agent continuity and can lead to silent interruption of work, incomplete outputs, or destruction of state users expected to preserve.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.