ClawHub
Back to skill

Security audit

Docker Hardening

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-aligned, with a privacy note around user/session identifiers rather than evidence of hidden or unsafe behavior.

Before installing, confirm you are comfortable sending linkable user/session identifiers to the service. Prefer pseudonymous or short-lived IDs if possible, and look for publisher documentation on retention, deletion, and who can access audit logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill explicitly includes sessionId, userId, and timestamp fields for tracking and audit purposes, but provides no privacy notice, retention details, consent expectations, or guidance on handling personal or linkable metadata. In a third-party security tool context, this creates a real privacy and data-governance risk because users may unknowingly transmit identifying or correlatable information to an external service.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The API schema explicitly accepts sessionId and userId fields, which are identifying metadata, but the OpenAPI document contains no indication of why they are needed, how they are used, or whether they are optional for privacy-preserving operation. In an agent skill context, this can lead to unnecessary collection and transmission of user-linked identifiers, increasing privacy risk, tracking potential, and the chance of improper downstream logging or retention.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.