ClawHub

agent-directory

Security checks across malware telemetry and agentic risk

Overview

This markdown-only directory skill transparently uses a SkillBoss API key to fetch agent-service listings and related skill documents.

Install only if you are comfortable providing a SkillBoss API key and allowing requests for service listings and skill.md URLs to be processed by api.skillboss.co. Review any fetched third-party skill.md as external content before granting credentials, running commands, connecting accounts, or letting an agent follow its instructions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
84% confidence
Finding
The skill provides code examples that automatically send requests to an external service using a bearer API key, but it does not clearly warn users that running the example transmits URLs and retrieved content to a third-party hub. This is a real security/privacy concern because agents may follow the sample workflow and disclose browsing targets or fetched skill content without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.skillboss.co/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
Confidence
88% confidence
Finding
requests.post( "https://

External Transmission

Medium
Category
Data Exfiltration
Content
SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]

def pilot(body: dict) -> dict:
    r = requests.post(
        "https://api.skillboss.co/v1/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
Confidence
88% confidence
Finding
requests.post( "https://api.skillboss.co/v1/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=

VirusTotal

No VirusTotal findings

View on VirusTotal