ClawHub
Back to skill

Security audit

Anti-Infinite-Loop Guard

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple local loop-guard helper with some overclaimed or placeholder documentation, but no hidden access, persistence, network use, or destructive behavior.

Install only if you want a lightweight local loop guard, and treat its published metrics and watchdog claims as unverified. Review or narrow the triggers if unexpected stopping behavior would disrupt long-running tasks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The module documentation is a placeholder that does not match the declared anti-infinite-loop functionality, which creates a deceptive interface between manifest and implementation. This is dangerous because operators or downstream agents may rely on the advertised safety control existing when it does not, weakening trust and potentially disabling expected loop-prevention safeguards.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The file implements only a placeholder CLI that prints a version string instead of performing anti-infinite-loop guarding as described by the skill metadata. In this context, the mismatch is security-relevant because users may deploy the skill expecting protection against repetitive execution and resource exhaustion, but receive no protection at all, enabling denial-of-service or runaway-agent conditions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.