ClawHub
Back to skill

Security audit

Secrets Manager

Security checks across malware telemetry and agentic risk

Overview

This is a local encrypted secrets utility with disclosed plaintext-output risks and no evidence of hidden exfiltration or unsafe install behavior.

Use this only as a local agent/development secrets store. Avoid --get --raw and --inject in CI, logged terminals, shell history, or process-visible command lines; do not treat it as a production vault or as enforcing per-secret permission rules. Keep memory/secrets out of git and back up the master key securely.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
This skill intentionally provides two plaintext secret exfiltration paths: `--get --raw` writes decrypted secrets to stdout, and `--inject` substitutes decrypted secrets directly into arbitrary command strings and emits the result. In an agent environment, stdout, command strings, shell history, process listings, logs, and downstream tools are common leakage surfaces, so a 'secure secrets store' that also acts as a plaintext secret emitter materially increases exposure risk.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The documentation warns that production should prefer environment-variable injection, but the implemented `--inject` feature performs plaintext placeholder replacement into a command string. That mismatch is dangerous because users may infer the feature is aligned with the stated secure design, while in practice it creates secret exposure through command arguments and any logging or shell execution path.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.