ClawHub
Back to skill

Security audit

ThingsBot

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent ThingsBoard admin helper, but it includes high-impact commands that can delete telemetry or publish dashboards without enough safety guidance.

Install only if you want an agent to administer ThingsBoard. Before using it, require explicit confirmation for telemetry deletion or dashboard publication, verify the tenant/device/dashboard IDs and keys, back up important telemetry, review dashboard contents for sensitive data, and revoke public dashboard access when it is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill documents making dashboards public and notes that public dashboard info requires no authentication, but the description does not clearly signal that it can intentionally expose data externally. In an IoT platform context, publishing dashboards can leak telemetry, device status, or operational metadata to unauthenticated users, making this more dangerous than ordinary REST-management documentation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill includes a destructive delete-timeseries operation with no warning about permanence, scope, or recovery. In a ThingsBoard environment, this can cause irreversible loss of telemetry history and impair monitoring, auditing, troubleshooting, and downstream automations.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill describes making dashboards public without warning that doing so enables unauthenticated access to dashboard information. In this context, dashboards may contain sensitive IoT telemetry, asset relationships, or operational views, so the omission meaningfully increases the chance of accidental exposure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.