ClawHub
Back to skill

Security audit

topos

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local code-quality tool, with disclosed setup and local artifact side effects that users should understand before enabling MCP integration.

Before installing, review the remote installer and npm package source you will trust. Use CLI-only mode if you only want local analysis. Run `topos install --all` only if you intentionally want Topos registered with agent harnesses, and expect `.gitnexus` files and possible project configuration changes during normal use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill exposes commands to install, uninstall, and register an MCP server across agent harnesses, which goes beyond passive code analysis and changes the user's local tool configuration. This broadens the trust boundary significantly: a user invoking a code-quality skill could end up altering editor/agent integrations or enabling persistent execution paths they did not explicitly intend.

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The documentation claims Topos 'reads local source files and git state only,' but elsewhere states that it writes .gitnexus artifacts and can persist configuration. Misstating side effects is security-relevant because it can cause users or agents to run the tool under an incorrect assumption of read-only behavior, potentially allowing unreviewed filesystem changes.

Intent-Code Divergence

Low
Confidence
82% confidence
Finding
Saying the skill 'does not modify source files unless the agent chooses to edit' is narrowly true, but it understates other local modifications such as artifact generation, config persistence, and MCP harness registration. This can mislead operators into treating the skill as non-invasive when it can still alter project or environment state.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.