Security audit
Oc Agent Loop
Security checks across malware telemetry and agentic risk
Overview
The skill set is mostly coherent and disclosed, but one review helper defaults to running nested Codex with full sandbox bypass, which is too much authority for routine code review.
Review carefully before installing. The Convex and ClawHub admin workflows are specialized and can affect production systems, so only use them in a trusted ClawHub maintainer environment. For autoreview, prefer running the helper with `--no-yolo` or `AUTOREVIEW_YOLO=0` unless you intentionally want nested Codex to have full filesystem and command authority.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.