ClawHub

EPAI

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed EPAI administration CLI, but it can upload selected local files and change or delete remote EPAI resources.

Install only if you want Codex to manage EPAI resources. Use a least-privileged EPAI API key, verify EPAI_API_BASE points to the intended service, keep TLS verification enabled, upload only documents meant for EPAI, and double-check IDs before running delete commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tainted flow: 'url' from os.getenv (line 93, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
parser_config = json.dumps({"lang_detect_enable": False,"backend": "pipeline-high-acc","chunk_type": "general","chunk_num": 256,"parent_chunk_num": 1024,"embed_model": "bge-m3","use_vision": True,"layout": True})
    data = {"parser_config": parser_config,"parse": "true","kb_id": kb_id}
    upload_files = [("files", (os.path.basename(f), open(f, "rb"))) for f in files]
    r = requests.post(url, headers=HEADERS, data=data, files=upload_files, verify=VERIFY_TLS, timeout=TIMEOUT)
    print(json.dumps(r.json(), ensure_ascii=False, indent=2))

def catalog_list():
Confidence
83% confidence
Finding
r = requests.post(url, headers=HEADERS, data=data, files=upload_files, verify=VERIFY_TLS, timeout=TIMEOUT)

Tainted flow: 'upload_files' from open (line 62, file read) → requests.post (network output)

High
Category
Data Flow
Content
parser_config = json.dumps({"lang_detect_enable": False,"backend": "pipeline-high-acc","chunk_type": "general","chunk_num": 256,"parent_chunk_num": 1024,"embed_model": "bge-m3","use_vision": True,"layout": True})
    data = {"parser_config": parser_config,"parse": "true","kb_id": kb_id}
    upload_files = [("files", (os.path.basename(f), open(f, "rb"))) for f in files]
    r = requests.post(url, headers=HEADERS, data=data, files=upload_files, verify=VERIFY_TLS, timeout=TIMEOUT)
    print(json.dumps(r.json(), ensure_ascii=False, indent=2))

def catalog_list():
Confidence
95% confidence
Finding
r = requests.post(url, headers=HEADERS, data=data, files=upload_files, verify=VERIFY_TLS, timeout=TIMEOUT)

Scope Creep

High
Confidence
99% confidence
Finding
The code can list, create, and delete remote resources and upload local files, but these capabilities exceed the manifest's declared file-read permission. This is a true security transparency issue because the skill can modify external state and transmit local content without the permission model reflecting that risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents destructive delete commands for knowledge bases, catalogs, and documents without warning that these actions may be irreversible or cause data loss. In an agent setting, missing safety language increases the chance of accidental destructive execution by users or automated workflows.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The upload example instructs reading local files and sending them to the EPAI platform without clearly warning that local file contents will leave the host environment. This can lead to inadvertent exfiltration of sensitive documents if a user or agent uploads the wrong files or does not understand the transmission boundary.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
Local files are uploaded to a remote API immediately after existence checks, with no warning, preview, or confirmation to the user. In a file-read-capable skill, the lack of explicit consent for external transmission increases the chance of accidental disclosure of sensitive local documents.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill deletes knowledge bases through a single command path with no confirmation, dry-run option, or safety prompt. This makes accidental or coerced destructive actions more likely, especially in an administrative CLI context.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Catalog deletion is performed immediately without interactive confirmation or a dedicated force flag. In an admin tool that manages shared remote resources, this weakens operational safety and increases the risk of accidental loss.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Document deletion executes without any user-facing warning or confirmation, allowing unintended destructive changes through simple CLI invocation. Because the skill targets a remote knowledge platform, the impact can affect shared content and may be difficult to recover.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal