ClawHub
Back to skill

Security audit

Zellij Terminal Workspace

Security checks across malware telemetry and agentic risk

Overview

The skill does what it advertises, but it gives an agent broad terminal control and documents detached autonomous coding-agent runs, so users should review its scope carefully.

Install only if you want an agent to control local zellij terminal sessions. Use a dedicated zellij data directory, avoid panes that may display credentials or private logs, verify session and pane IDs before sending input, and allow --yolo/--full-auto agent runs only for explicitly requested work in disposable or tightly scoped workspaces.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly instructs operators to send arbitrary command strings into active zellij panes and later documents deleting sessions, but it does not provide safety guardrails or warnings about command injection, targeting the wrong pane/session, or terminating ongoing work. In a remote-control skill, these actions are the core mechanism, so lack of validation and caution materially increases the chance of destructive or unintended command execution.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
On timeout, the script prints the full scraped pane contents to stderr. Because this skill is specifically designed to remote-control interactive CLIs, pane output may contain secrets, tokens, credentials, personal data, or other sensitive terminal content, so a failure path can unintentionally expose data to logs, calling processes, or users who should not see it. The skill context makes this more dangerous, not less, because pane scraping is its core function and interactive CLI sessions commonly display sensitive material.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.