ClawHub
Back to skill

Security audit

Env Doctor

Security checks across malware telemetry and agentic risk

Overview

Env Doctor is a local .env checker whose sensitive file access is disclosed and aligned with its purpose.

Install only if you want a local tool to inspect selected .env files. Because its reports can reveal sensitive variable names, file paths, line numbers, and possibly malformed-line snippets, avoid publishing or broadly logging the output, especially in CI.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
79% confidence
Finding
The invocation text is broad enough that the skill may activate for generic requests about environment variables, secrets, or configuration audits, causing it to access sensitive .env content in more situations than necessary. In a system with automatic or fuzzy skill routing, over-broad triggers increase the chance of unnecessary credential exposure to the skill.

Missing User Warnings

Low
Confidence
84% confidence
Finding
When --json is used, the tool emits structured details about detected secret-bearing variables, including key names and line numbers. In many workflows this output may be logged, stored in CI artifacts, or forwarded to other systems, which can increase exposure of sensitive metadata even if full secret values are not printed.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.