ClawHub
Back to skill

Security audit

Janitor

Security checks across malware telemetry and agentic risk

Overview

This workspace cleanup skill has a coherent purpose, but it asks for broad file cleanup and sensitive config-checking authority without enough user-control safeguards.

Review before installing, especially before enabling scheduled runs. Use only with workspace-scoped permissions, require a dry-run report and explicit approval before any archive or delete action, and ensure reports never include raw API keys, tokens, or secret config values.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly instructs archival and cleanup of workspace data on a schedule, including moving files and cleaning abandoned directories, but it does not require explicit confirmation, preview, rollback guidance, or clear safety bounds before modifying data. In a maintenance agent, these actions are expected, yet the lack of guardrails increases the risk of unintended data loss, disruption of active work, or overbroad cleanup if the agent misclassifies files as stale or orphaned.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal