ClawHub
Back to skill

Security audit

Terraform Config Builder / Terraform 配置生成

Security checks across malware telemetry and agentic risk

Overview

This skill is framed as a Terraform generator but mostly contains generic marketing and unrelated affiliate links, so users should review it before trusting it.

Install only if you are comfortable with a low-functionality promotional skill. Do not rely on it to produce safe Terraform, and avoid following unrelated commercial links unless you independently trust them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill advertises Terraform configuration generation but the file content is largely marketing copy, upgrade prompts, and affiliate links rather than actionable implementation or safe usage guidance. This mismatch can mislead users and downstream agents into trusting the skill's stated purpose while exposing them to irrelevant commercial content, reducing transparency and increasing social-engineering risk.

Context-Inappropriate Capability

Low
Confidence
97% confidence
Finding
The inclusion of unrelated promotional and affiliate links in a Terraform-building skill is unjustified and creates a social-engineering and trust-abuse risk. Users may be steered to external commercial services unrelated to the skill's function, and in an agent ecosystem this kind of content can be used to monetize or redirect user attention under the guise of infrastructure tooling.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.