ClawHub
Back to skill

Security audit

Container Runtime Threat Model Generator

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: it sends container configuration details to ToolWeb to generate a threat model, so users should only submit information they are comfortable sharing.

Install this only if you trust ToolWeb with the container architecture and security-control details you provide. Avoid submitting actual secrets, credentials, proprietary identifiers, or unnecessary production details, and review ToolWeb's privacy, retention, and billing terms before using it on sensitive or regulated systems.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to send detailed container architecture, security controls, privileges, secrets-handling practices, compliance scope, and data sensitivity to a third-party API, but it does not require an explicit user warning or consent step before transmission. In a security-review context, this metadata can materially aid attackers or violate internal data-handling restrictions if exfiltrated to an external service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.