ClawHub
Back to skill

Security audit

cross-platform-memory-hub

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed memory-hub template with a clearly documented paid clawtip workflow, and the reviewed artifacts do not show hidden data exfiltration or destructive behavior.

Install only if you are comfortable with a skill that can read and write approved local memory files and uses clawtip for a paid feature. Review the payment amount and order details before authorizing clawtip, and set CLAWTIP_* variables only for the intended payment workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The script introduces payment/order creation behavior inside a skill advertised as a cross-platform memory hub, creating a strong mismatch between stated purpose and actual capabilities. That mismatch is dangerous because users or agents may grant trust and execution privileges appropriate for memory tooling while unknowingly invoking commerce-related logic that handles payment metadata and order generation.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code reads payment-related environment variables such as CLAWTIP_PAY_TO and CLAWTIP_SM4_KEY even though those secrets are unrelated to core memory management. In an agent-skill context, accessing unrelated credentials expands the trust boundary and creates a path for secret exposure, misuse, or unauthorized billing workflows if the surrounding ecosystem auto-injects environment variables.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The docstring and console messaging normalize the script as harmless local order creation while it remains packaged under an unrelated memory-hub skill identity. This kind of framing can mislead reviewers and users, making suspicious billing behavior appear routine and lowering the chance that credential access or order generation will be scrutinized appropriately.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def create_order_file(question: str, indicator: str) -> dict:
    pay_to = os.environ.get("CLAWTIP_PAY_TO", "")
    sm4_key = os.environ.get("CLAWTIP_SM4_KEY", "")

    if not pay_to:
        print("WARNING: CLAWTIP_PAY_TO environment variable not set")
Confidence
96% confidence
Finding
The script harvests a sensitive cryptographic key from the environment (CLAWTIP_SM4_KEY) and uses it in functionality unrelated to the advertised memory-hub purpose. In agent environments, environment variables often contain high-value secrets, so unnecessary secret access is dangerous even without direct exfiltration because it increases the blast radius of a compromised or misleading skill and can enable downstream leakage via logs, files, crashes, or dependent functions such as save_order.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.