ClawHub
Back to skill

Security audit

homarr

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Homarr helper, and the flagged credential item is just a normal local development setup example.

Reasonable to install for Homarr-related assistance. Review any suggested pnpm, Docker, git, curl, or configuration command before running it, keep API keys and tokens server-side, and only enable iframe permissions that the embedded service actually needs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Content
cd homarr
pnpm install
pnpm run docker:dev
cp .env.example .env
# set DB_URL to a sqlite path
pnpm run db:migration:sqlite:run
pnpm dev
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.