qa-security

• Outcome: Pass
• Latest audit: Jul 28, 2026 · 2:20 PM UTC
• Version: 1.0.27

Overview

This paid QA/security review skill discloses its clawtip payment flow and local order storage, and the inspected code matches that disclosed workflow.

Install only if you are comfortable with a paid clawtip-gated workflow. Do not include secrets, API keys, or highly sensitive code details in the question field, because the question is saved in a local order JSON file and no automatic cleanup is documented.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill is presented primarily as a security/code-audit service, but the workflow also includes payment processing, local order-file creation, and handling of user-supplied question content. That mismatch can mislead users about what data is being stored and processed, increasing the risk of unintended disclosure of sensitive prompts, project details, or payment metadata in local files.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements payment/order creation logic inside a skill advertised as QA/security guidance, which is a strong mismatch between stated purpose and actual behavior. Creating local order artifacts tied to payment flow can facilitate unauthorized monetization, deceptive billing workflows, or staging of later exfiltration/payment steps, especially in an environment where users expect analysis rather than commerce.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads payment recipient and encryption key environment variables even though the skill's declared purpose is security analysis, not payment processing. Accessing sensitive runtime configuration unrelated to the advertised function increases the risk of secret misuse and covert payment manipulation, and the context makes this behavior more suspicious rather than justified.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring presents the file as part of a QA/security skill, but the implementation is an order/payment script. This deceptive labeling can help conceal risky behavior from reviewers and users, making it easier for inappropriate financial or data-handling logic to bypass scrutiny.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: This file persists arbitrary order data to local disk and reads it back later, which is unrelated to the stated purpose of a QA/security audit guidance skill. In a security-review context, unjustified persistence increases data-retention and privacy risk because user-provided content may be stored on the host without a clear need, disclosure, or lifecycle control.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The module implements a local order-management subsystem even though the skill is described as security audit guidance. That capability mismatch is suspicious because it expands the skill’s data-handling surface and can enable unintended collection or retention of operational data on the user’s machine.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s implemented behavior is payment verification and authorization, which is unrelated to the declared security-review function of the skill. In a skill ecosystem, this kind of capability mismatch is dangerous because it can mislead operators into invoking a tool for benign analysis while it actually gates execution on payment state and handles transactional artifacts, indicating deceptive packaging or unauthorized monetization logic.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module docstring and CLI description present the script as a qa-security service, but the code actually performs payment authorization. This deceptive framing increases the risk of social engineering, operator confusion, and hidden business-logic abuse because reviewers and users may trust the skill based on its stated purpose while overlooking unrelated sensitive behavior.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: Order data is written to disk without any indication in this file that the user is warned or that storage is disclosed. Silent persistence is dangerous because it can surprise users, leave sensitive content behind on shared systems, and complicate compliance with privacy and data-minimization expectations.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def create_order_file(question: str, indicator: str) -> dict:
    pay_to = os.environ.get("CLAWTIP_PAY_TO", "")
    sm4_key = os.environ.get("CLAWTIP_SM4_KEY", "")

    if not pay_to:
        print("WARNING: CLAWTIP_PAY_TO environment variable not set")

• Confidence: 82% confidence
• Finding: This finding reflects access to an environment variable containing a cryptographic key, which is sensitive material. Although the code does not exfiltrate it directly in this snippet, harvesting or consuming such secrets in a skill unrelated to cryptographic payment handling is unjustified and expands the blast radius if the skill is abused or modified.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.