ClawHub

Device Magic

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Device Magic integration, but it gives an agent broad authenticated write, delete, and raw API powers without explicit safety checks.

Install only if you are comfortable granting Membrane-mediated access to Device Magic. Use the least-privileged account or connection available, verify the CLI package source, and require explicit approval before any create, update, delete, destination, resource, device, group, or raw proxy request.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The skill description is broad enough that it could be invoked for generic requests involving Device Magic data without clearly scoping allowed operations. In a capability-bearing integration skill that includes read, create, update, and delete actions, ambiguous routing can lead to unintended access or modification if the agent selects the skill too aggressively.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill documents destructive capabilities such as updating and deleting forms but provides no warning, confirmation requirement, or safe-handling guidance. In an agent setting, this increases the chance of accidental or unauthorized state changes because the documentation normalizes execution of mutating actions alongside harmless read operations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal