ClawHub
Back to skill

Security audit

npm Registry

Security checks across malware telemetry and agentic risk

Overview

This npm Registry skill uses ClawLink to access npm data and discloses credential use plus confirmation-gated write actions, with no hidden executable behavior found.

Install only if you are comfortable connecting npm through ClawLink. Review the live tool list after setup, use the least-privileged npm account or token practical, and do not approve token deletion, scope changes, or other write previews unless you explicitly intended that action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill is presented as an npm registry exploration and health-check capability, but its documented execution model explicitly contemplates write operations and confirmation flows. This expands the effective privilege and attack surface beyond the advertised read-focused purpose, increasing the risk that a user or downstream agent invokes state-changing npm account actions they did not expect.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.