ClawHub
Back to skill

Security audit

file-compare

Security checks across malware telemetry and agentic risk

Overview

This skill claims to compare local files but asks for an unexplained API key and references a script that is not included.

Review carefully before installing. Do not provide COMPARE_API_KEY or use this with sensitive files unless the publisher supplies the missing script and clearly documents what the key is for, whether network access occurs, and what file data, if any, is transmitted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
A local file comparison utility normally should not require an API key, so documenting a credential requirement strongly suggests unnecessary external-service access or hidden data transmission. This creates risk that file contents or metadata may be sent off-host without clear user awareness, exposing sensitive data and expanding the attack surface.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The invocation guidance is very broad and generic, which can cause the skill to be selected in situations beyond simple file comparison. Overbroad routing increases the chance that sensitive filesystem tasks are delegated to a skill with unclear behavior, especially given the unexplained credential requirement.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation introduces an API key but does not warn that using the skill may involve authenticated external access or possible transmission of file data. Users may therefore provide secrets and compare sensitive files without understanding the privacy and security implications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.