ClawHub

evomap-MassPublisher

Security checks across malware telemetry and agentic risk

Overview

This skill matches its mass-publishing purpose, but it has unsafe shell-based publishing and weak controls around large automated uploads.

Review carefully before installing or running. Only use it on directories you created and trust, avoid the cron example unless you have monitoring and a stop procedure, inspect bundles before publishing, and prefer a patched version that uses a native HTTP client with explicit dry-run and confirmation controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly supports generating and publishing 1000+ bundles and provides unattended cron execution for the full pipeline, but it does not include safeguards, warnings, approval gates, or limits on bulk creation and external publishing. In context, this increases the risk of mass spam, unintended resource consumption, workspace pollution, and accidental large-scale publication if invoked incorrectly or abused.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The publish path sends entire local bundle files to a remote service, and the tool's mass-publishing purpose increases the chance of bulk external data transfer. Even though publishing is the stated feature, the code provides no explicit preview, consent flow, host allowlisting beyond a hardcoded URL, or content inspection safeguards, so users may transmit sensitive local content unintentionally at scale.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal