Security audit
Affinity Readonly
Security checks across malware telemetry and agentic risk
Overview
The skill bundle is mostly coherent for ClawHub and Convex maintenance, but one review helper defaults to broad sandbox-bypassing execution and may send repository diffs to external reviewer CLIs.
Install only if you trust the publisher and need ClawHub/Convex maintainer automation. Review the autoreview helper before use, consider setting AUTOREVIEW_YOLO=0 or using --no-yolo, and be aware that fallback reviewers may receive repository diffs. Use moderation and PR-publishing commands only with the intended account credentials and after checking the exact command targets.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.