ClawHub
Back to skill

Security audit

skill-prescan

Security checks across malware telemetry and agentic risk

Overview

The skill’s scanning purpose is plausible, but its privacy boundary is unclear because it presents as local while sending analyzed skill content to a remote LLM provider.

Install only if you are comfortable sending the scanned SKILL.md and related metadata to the configured LLM provider. Avoid scanning proprietary or secret-containing skills unless the provider, retention terms, and file scope are acceptable; use a dedicated API key where possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares itself as a local pre-scan utility, but its documented behavior requires reading a user-supplied SKILL.md, accessing API-key environment variables, and sending the full file contents over the network to a third-party LLM endpoint. Even though this is disclosed later in the document, the absence of explicit declared permissions creates a transparency gap that can mislead users about the actual trust boundary and data exposure involved.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill description materially overstates 'local' scanning while the documented implementation transmits the full SKILL.md to remote LLM providers and may include a manifest of other files. This mismatch can cause users to disclose sensitive or proprietary content under a false assumption of local-only analysis, making the issue more dangerous because the skill is framed as a privacy-preserving prescan tool.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.