ClawHub
Back to skill

Security audit

Write

Security checks across malware telemetry and agentic risk

Overview

This writing skill is not clearly malicious, but it needs Review because it can delete files through an under-scoped cleanup script and can persistently change its own writing preferences.

Install only if you are comfortable with a writing assistant that manages a local workspace, saves drafts and research notes, and can delete old version files. Before using cleanup, verify the workspace and piece ID are exactly the intended ones, and avoid letting the skill silently rewrite its own SKILL.md preferences without explicit approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# Delete oldest versions
ls -1t "$VERSION_DIR" | tail -n "$DELETE" | while read f; do
  rm "$VERSION_DIR/$f"
  echo "🗑️  Deleted: $f"
done
Confidence
91% confidence
Finding
rm "$VERSION_DIR/

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.