ClawHub

Nano Gpt

Security checks across malware telemetry and agentic risk

Overview

This skill coherently wraps the NanoGPT API and only sends user-provided prompts or media, though users should prefer environment variables over storing the API key locally.

Install only if you intend to use NanoGPT. Prefer setting NANO_GPT_API_KEY in your environment rather than saving the token with config set, and only pass local image or video paths when you intend those files to be uploaded to the configured NanoGPT endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The `config set` flow allows storing an API key persistently without any warning, guidance, or visible safeguards about how and where the secret will be stored. In a local CLI that handles a paid or sensitive API credential, this increases the chance users place secrets into plaintext or weakly protected config files, leading to credential exposure through local compromise, backups, logs, or accidental sharing.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code persists the API key into a plaintext JSON config file in the user's home/config directory via writeFile, with no permission hardening, encryption, or user-facing warning at the point of storage. If the local machine is multi-user, backed up, synced, or otherwise exposed, the secret can be recovered and used to access the NanoGPT API as the user.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal