ClawHub
Back to skill

Security audit

Password Generator Pro

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward local password generator with no evidence of hidden access, persistence, networking, or data collection.

This is suitable to install if you want a local command-line password generator. Generated passwords are printed to the terminal, so avoid running it where terminal history, logs, screen sharing, or other observers could capture the output, and do not reuse the sample password shown in the documentation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
The file is primarily written in English, but Scenario 4 switches to Chinese for both the user input and expected output. This introduces a language-specific interaction pattern without stating that the skill is multilingual or giving users an explicit language/locale choice, which can conflict with language/locale policy expectations.

Session Persistence

Medium
Category
Rogue Agent
Content
**User input:** "Generate a secure password for my new account"
**Expected output:** The tool outputs a randomly generated 16-character password using mixed case letters, digits, and special symbols, along with the command used.

### Scenario 2: Create a Custom-Length Password
**User input:** "I need a 32-character password with all character types"
**Expected output:** The tool generates a 32-character password with symbols and numbers included, using `--length 32` option.
Confidence
60% confidence
Finding
Create a Custom-Length Password **User input:** "I need a 32-character password with all character types" **Expected output:** The tool generates a 32-character password with symbols and numbers inclu

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
password_generator.py:61