ClawHub
Back to skill

Security audit

Pget

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a disclosed download/extraction helper, but users should be careful with its optional system-wide pget install and archive extraction steps.

Install only if you trust the pget GitHub source and are comfortable with a system-wide binary installed via sudo. For downloads and archives, use a safe destination directory, avoid force-overwrite options unless needed, and inspect archive contents before extracting untrusted files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs users to download files and optionally extract tar archives, but it does not warn that these actions can create, overwrite, or expand files on the local filesystem. This is dangerous because untrusted URLs, manifests, or archives may clobber existing data or unpack unexpected paths and contents, especially when combined with `--force` or batch workflows.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.