ClawHub

Interop Forge

Security checks across malware telemetry and agentic risk

Overview

Interop Forge is a disclosed monorepo integration helper that can create repository files and scaffold network-capable auth, SDK, and MCP code, but those capabilities fit its stated purpose.

Install only when you want an assistant that may modify a monorepo. Review its plan and diffs before accepting changes, use least-privilege service tokens, do not place secrets in generated files, and inspect generated MCP/auth/webhook code before running or deploying it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill claims it never makes direct API calls itself, but the included implementations perform outbound network operations via Supabase token verification and webhook delivery. This mismatch can mislead users and downstream safety systems about the skill's real behavior, increasing the chance that network-capable code is generated or executed without appropriate review.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill repeatedly describes creating packages, specs, servers, and configuration files, but it does not give a prominent upfront warning that invoking it may modify the workspace. This can lead to unexpected file creation and configuration changes in a repository, which is especially risky in infrastructure-heavy monorepos where generated auth, SDK, and MCP files affect trust boundaries.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal