ClawHub
Back to skill

Security audit

Iterate

Security checks across malware telemetry and agentic risk

Overview

This skill openly automates code review, edits, commits, merges, and pushes; that is high-impact but coherent with its stated purpose and guarded by explicit invocation and workflow controls.

Install only if you want an explicitly invoked automation skill that can change code and push commits. Before use, consider setting git.push_per_round to false, verify the target branch, and review generated commits and the decision log before allowing remote updates.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill is explicitly designed to modify files, create branches/worktrees, merge changes, and potentially push to a remote, but the top-level description does not prominently warn users about these high-impact side effects. This increases the risk of accidental invocation and unintended repository changes, especially because the workflow is highly automated and multi-round.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
1. **Backup tag / 备份标签**
   - 在 commit 前为当前迭代分支打标签：`git tag iterate/round-{round}-backup`
   - 若后续需要回滚，可 `git reset --hard iterate/round-{round}-backup`（仅用于迭代分支，不用于 main/master）。

2. **Commit / 提交**
   - `git add <changed files>`
Confidence
91% confidence
Finding
git reset --hard

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.