ClawHub
Back to skill

Security audit

Brief

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed briefing assistant that stores local format preferences but does not show hidden access, exfiltration, or destructive behavior.

Install only if you are comfortable with the skill keeping local briefing preferences and reading Clawic profile defaults for locale/timezone. Avoid putting sensitive free-form information into preference feedback, and review or delete ~/Clawic/data/brief/ if you want to reset what it has learned.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly instructs the agent to persist user preferences to files under ~/Clawic/data/brief without any notice, consent, retention limits, or sensitivity checks. Even though the data appears productivity-related, user reactions and stated preferences can contain personal or organizationally sensitive information, creating a privacy and data-governance risk through silent long-term storage.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.