ClawHub

iBus.CL CLI (API Transporte RED Chile)

Security checks across malware telemetry and agentic risk

Overview

This skill is a narrow bus-arrival CLI guide, with the main caution that its recommended install command runs an unpinned remote GitHub shell script.

Reasonable to install if you trust the linked repository, but do not blindly run the curl-to-bash command. Prefer cloning the repo, reviewing install.sh, and installing manually or from a pinned release when available.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs users to execute a remotely fetched shell script directly via `bash <(curl ...)`, which prevents meaningful inspection before execution and creates a supply-chain/RCE risk if the GitHub account, repository, branch, or network path is compromised. In a skill context, documentation that normalizes this pattern materially increases danger because users are likely to copy-paste it with their current privileges.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal