ClawHub
Back to skill

Security audit

Agent Caps

Security checks across malware telemetry and agentic risk

Overview

This is an offline Python tool for checking and creating agent manifest files, and its file access matches that purpose.

Expect this skill to read manifest JSON files you point it at and to create or overwrite agent-manifest.json when you run scaffold on a directory. Avoid piping a fresh remote download directly into execution unless you trust the source and have checked the file you received.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation advertises and operationalizes a Python CLI that users download and run locally, and the static analyzer detected file read and file write capabilities, but the skill declares no corresponding permissions. This creates a trust and audit gap: installers and security reviewers may believe the skill is non-invasive when it can access or modify local files during validation, scaffolding, or self-test operations.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The manifest grants broad operational tools including terminal, browser, delegate, cron, and skill installation despite the stated purpose being capability definition, validation, and auditing. This creates unnecessary execution and automation reach, increasing the attack surface and enabling command execution, delegated actions, scheduled persistence, or acquisition of additional capabilities if the agent or its configuration is abused.

Context-Inappropriate Capability

Medium
Confidence
85% confidence
Finding
Declaring GitHub ops capability and a git CLI dependency appears misaligned with a manifest-auditing skill and may permit repository modification, credential use, or code movement beyond the advertised function. In this context, the mismatch between purpose and capability is itself risky because it can mask overprivileged access that would be valuable if the agent were compromised or misused.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
test_agent_caps.py:14