ClawHub

Swarm Kanban

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed task-management integration, but users should be aware it sends task and team data to an external service.

Install only if you are comfortable using the swarm-kanban external service for your project tasks. Keep bearer tokens out of logs and chat transcripts, and avoid putting confidential business, customer, or credential data into task content unless you have decided that service is appropriate for that data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are broad, ordinary collaboration terms such as 'create a team', 'join team', and 'collaborate on', which can cause accidental invocation in unrelated conversations. Because this skill performs authenticated network actions against an external service, unintended activation could lead to unwanted account creation, task changes, or data disclosure.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents external API use, JWT handling, and backend persistence, but it does not prominently warn users that information will be transmitted to a third-party service and that tokens must be stored and reused. This increases the risk of users or agents sending sensitive project data off-platform without informed consent or exposing bearer tokens in logs and downstream messages.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal