ClawHub
Back to skill

Security audit

Kubernetes Security Posture Scorecard

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is a disclosed ToolWeb API integration for Kubernetes security scoring, with no evidence of hidden code, persistence, local cluster mutation, or destructive behavior.

Install only if you are comfortable sending Kubernetes posture details to ToolWeb and using a ToolWeb API key that may affect quota or billing. For sensitive clusters, minimize the submitted data, leave optional notes empty unless necessary, and do not include secrets, kubeconfig contents, tokens, private endpoints, or unnecessary internal identifiers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly requires sending detailed Kubernetes security posture data to a third-party API, but it does not instruct the agent to obtain informed user consent or warn that cluster configuration details will leave the local environment. Security architecture details, control gaps, and provider/version metadata can materially aid an attacker if disclosed, especially for production clusters.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill collects free-form notes and additional cluster context, then includes them in the external API payload without warning users not to include secrets, credentials, internal hostnames, tokens, or other sensitive operational details. Free-text fields are a common path for accidental exfiltration because users may paste privileged data that is not necessary for scoring.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.