ClawHub
Back to skill

Security audit

database-specialist

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed paid database-advice workflow using clawtip payment verification, with local order storage but no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable with a paid clawtip-mediated workflow. Avoid putting database credentials, connection strings, or sensitive schema details in the initial question because the question is saved in a local order JSON file. Review the clawtip payment step and amount before paying.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The skill is presented as a database advisory service, but the documented workflow is primarily a payment-gated order system with local storage, credential handling, and authorization checks. That mismatch can mislead users into granting sensitive permissions or sharing database-related material under false expectations, increasing the risk of data exposure or abuse even if no explicit exfiltration is stated here.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The file’s stated purpose is database consultation, but it actually creates payment order artifacts and handles payment metadata. That mismatch is security-relevant because it introduces undisclosed billing behavior and payment workflow logic unrelated to the advertised skill, increasing the likelihood of deceptive or unauthorized monetization.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code accesses payment-related environment variables and performs encryption despite the skill being described as a database architecture/SQL assistant. In this context, those capabilities are unjustified and dangerous because they enable hidden payment processing behavior and interaction with sensitive configuration outside the user’s expected trust boundary.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
This file implements local order-record storage and retrieval unrelated to the stated purpose of a database architecture/SQL optimization skill. Hidden persistence increases the skill's data-handling scope and creates unnecessary exposure of per-user data on disk, especially because the storage occurs under the user's home directory without any visible need tied to the advertised functionality.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The code gives the skill filesystem read/write access for per-user order records even though such capability is not justified by a database-specialist skill. This expands the trust boundary from transient analysis to persistent local storage, enabling collection or retention of user data that may be unexpected and harder to monitor.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The script treats a missing payStatus as "SUCCESS" via order_data.get("payStatus", "SUCCESS"), so any order file containing a payCredential can be authorized even when no successful payment status was recorded. Because is_credential_valid only checks for presence of payCredential and optional TTL, an attacker who can influence the local order file may bypass payment enforcement and obtain unauthorized service access.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The save operation writes JSON files to a user-home directory silently, with no user-facing warning, disclosure, or consent flow. Even if the path validation prevents traversal, undisclosed persistence is dangerous because it can retain sensitive prompts, outputs, or business data in a location the user may not realize is being populated.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def create_order_file(question: str, indicator: str) -> dict:
    pay_to = os.environ.get("CLAWTIP_PAY_TO", "")
    sm4_key = os.environ.get("CLAWTIP_SM4_KEY", "")

    if not pay_to:
        print("WARNING: CLAWTIP_PAY_TO environment variable not set")
Confidence
88% confidence
Finding
The script reads a secret-like environment variable (CLAWTIP_SM4_KEY) and uses it to process payment payload data. Although it does not exfiltrate the value directly in this snippet, harvesting a cryptographic key inside an unrelated skill is risky because it expands secret exposure to code that does not need it and could facilitate misuse if the skill is modified or chained with other behaviors.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.