ClawHub
Back to skill

Security audit

Share use case

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent public-sharing helper, but users should review drafts carefully because it can turn recent chat context into a live public submission.

Install only if you are comfortable letting the assistant summarize recent chat into content that may become public. Before approving submission, remove secrets, client names, internal URLs, unreleased plans, and personal or business-sensitive details; use anonymous submission if you do not want a GitHub or X identity attached.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill advertises and instructs use of multiple code-driven capabilities such as Node scripts, polling, OAuth credential retrieval, and likely environment-backed configuration, yet no permissions are declared. This creates a transparency and governance gap: users and policy enforcement layers cannot accurately understand that the skill may access runtime capabilities and external services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior goes beyond a simple 'share use case' workflow by retrieving OAuth credentials from a remote service, continuously polling for auth completion, and submitting externally, while the description understates these actions. Misleading descriptions reduce informed consent and can conceal sensitive operations such as credential handling and off-platform data transfer.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to mine the last 50-100 messages or several hours of conversation and transform that material into a public submission, but it does not require a clear upfront privacy warning or granular consent for what specific content will be shared. This can expose sensitive project details, credentials-adjacent information, business context, or personal data that appeared earlier in the conversation.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script retrieves an OAuth credential from a remote service and writes the full credential object directly to stdout. Stdout is commonly captured by shells, logs, CI systems, parent processes, terminal history tooling, or other automation, so this can unintentionally disclose long-lived access tokens or refresh tokens far beyond the intended recipient.

Ssd 3

Medium
Confidence
98% confidence
Finding
The skill explicitly directs reuse of conversation history for external publication, which is a direct data exfiltration risk when prior messages contain confidential implementation details, internal URLs, customer information, or secrets. Even if framed as convenience, automatically mining and republishing user-provided details increases the chance of oversharing beyond what the user intended.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.