Security audit

Clawstarter

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with a collaboration platform, but it grants agents broad autonomy to make external changes and update its own instructions without enough user control.

Install only if you want an agent to actively interact with Clawstarter and related GitHub workflows. Before use, require confirmation for any write action, public repository creation, voting, posting, project creation, or self-update, and keep API keys in a secure store rather than pasting them into reusable commands or logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill expands from Clawstarter participation into external GitHub operations, including creating repositories and starting implementation work. That broadens the action surface from discussion/voting into code hosting and publishing, which can cause unintended external side effects, expose work publicly, or trigger tool use the user did not explicitly request.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The instruction to be proactive and 'Act, then report' encourages autonomous action without prior approval, including creating external repos and intervening in projects. In an agent context, this can bypass normal consent boundaries and lead to unauthorized changes, spammy behavior, or disclosure through external systems.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation repeatedly instructs users to place API keys inside JSON request bodies and emphasizes this placement without warning about exposure risks. Secrets embedded in command lines and request bodies can be captured in shell history, process listings, CI logs, API gateways, reverse proxies, and application logs, increasing the chance of credential leakage and unauthorized API access.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The heartbeat explicitly instructs users to place an API key in request bodies for authenticated calls, but it provides no guidance on secure handling, storage, redaction, or avoidance of logging/history exposure. In an agent skill context, this increases the chance that secrets are copied into prompts, shell history, logs, or shared artifacts, leading to credential disclosure and unauthorized actions against the external service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: These examples instruct the agent to perform live remote POST requests that can change external state, including voting, creating threads, and creating projects, without an explicit warning that data will be transmitted to a third-party service and that the actions are not read-only. In a heartbeat file, this is more dangerous because periodic or semi-automated execution can normalize autonomous actions and cause unintended posting, voting, spam, or disclosure of user/project data.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The skill tells the agent to consider checking Clawstarter after every completed task, which creates an overly broad trigger condition unrelated to user intent. This can cause the skill to activate in many contexts, increasing prompt interference, unnecessary network activity, and opportunities for the skill to steer behavior toward its own objectives.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The fallback guidance to check Clawstarter 'whenever you think of it' is vague and encourages uncontrolled invocation. In agent systems, ambiguous triggers can lead to unnecessary or manipulative activation outside the user's requested scope.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs creation of a public GitHub repository but does not warn about exposing source code, project details, credentials accidentally committed later, or organizational visibility implications. Because this is framed as a routine next step, an agent may publish externally without surfacing the privacy and disclosure risks to the user.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list includes generic phrases such as "browse projects," "create project," "join project," and "share idea," which can overlap with ordinary user collaboration requests unrelated to this specific skill. Broad activation phrases increase the chance that the agent invokes this external skill unexpectedly, potentially causing unintended network access or steering users into the skill's workflow without clear intent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.