ClawHub
Back to skill

Security audit

Skills Manager CLI

Security checks across malware telemetry and agentic risk

Overview

This documentation-only skill is coherent for managing Skills Manager CLI links, with disclosed local file-moving behavior that users should preview before applying.

Before installing or using this skill, understand that skm commands can change local skill folders and links for multiple AI tools. Use dry-run or diagnostic commands first, review what will be moved or repaired, and only run apply commands such as adopt --yes --json or fix --yes --json when you intend those local changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill instructs agents to run `skm adopt --yes --json`, and later explains that `adopt` moves existing real directories from tool-specific skill folders into the central hub. Although the move is documented elsewhere, the workflow and command map do not foreground the destructive nature or require an explicit user confirmation before applying it, which increases the risk of unintended relocation of user-managed skill directories and possible workflow disruption.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation explicitly states that `adopt --json` without `--yes` still performs adoption because the confirmation prompt is skipped. For automation or agents that commonly treat `--json` as a read-safe output mode, this creates a semantic trap where a seemingly inspection-oriented command mutates user state, potentially importing unmanaged skills unexpectedly.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The docs note that `init --json` is not a no-op when already initialized and may refresh the companion skill and re-enable it for active tools. This is a real side effect, and if callers assume `init --json` is idempotent/read-safe status checking, they may unintentionally alter local tool configuration.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.