Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/install-global-skill.js:50
Security audit
Install Skills from Clawhub for all Agents
Security checks across malware telemetry and agentic risk
Overview
This skill does what it says, but it can persistently replace global agent skills and its helper script uses an unchecked slug in recursive file operations.
Review before installing. Use only exact trusted ClawHub slugs, avoid any slug with slashes or dot segments, and keep backups enabled. The publisher should add strict slug validation and path containment checks before this is treated as a low-risk global skill manager.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.dangerous_exec