ClawHub
Back to skill

Security audit

File share

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed file-sharing tool, but it can upload sensitive workspace files to a third-party service with weak path containment and no clear confirmation step.

Install only if you are comfortable letting the agent upload selected files to transfer.whalebone.io and return a shareable download URL. Review file contents first, avoid secrets, private logs, memory files, credentials, and regulated data unless encrypted, and prefer a more controlled transfer channel until confirmation and path containment are improved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill facilitates uploading arbitrary workspace files to an external third-party service, but the description does not prominently warn users that data leaves the local environment and may be exposed to an external provider. This can lead to accidental exfiltration of sensitive logs, reports, credentials, or internal artifacts because users may interpret the action as routine local file handling rather than external sharing.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This skill is explicitly designed to exfiltrate workspace files to an external host, but it does not present a clear, explicit user-facing disclosure of the privacy and confidentiality consequences before transmission. In an agent-skill context, workspace contents may include secrets, credentials, internal documents, or memory artifacts, so sending them to a third-party transfer service materially increases data-leak risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.