ClawHub

snipit.sh

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward snippet-sharing helper, but anything shared through it is uploaded to the snipit.sh service.

Install only if you trust snipit.sh and the snipit-sh npm package. Before using it, review exactly what file or command output will be uploaded, avoid sharing production credentials or regulated data unless policy permits it, and prefer redaction, password protection, burn-after-read, and short expirations for sensitive snippets.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly encourages sharing code, configs, logs, diffs, and secrets with a third-party service, but it does not prominently warn users that this transmits potentially sensitive material outside the local environment. Even if the service uses encryption and supports passwords or expiration, users may still disclose credentials, proprietary code, tokens, or regulated data to an external host without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Create
curl -X POST https://snipit.sh/api/snippets \
  -H "Content-Type: application/json" \
  -d '{"content":"code","language":"python","burnAfterRead":true}'
Confidence
88% confidence
Finding
curl -X POST https://snipit.sh/api/snippets \ -H "Content-Type: application/json" \ -d

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal