ClawHub
Back to skill

Security audit

Uptime Monitor

Security checks across malware telemetry and agentic risk

Overview

This uptime-monitoring skill behaves consistently with its stated purpose, with expected network checks, optional alerts, and local logs.

Install this only for endpoints you are authorized to monitor. Avoid URLs containing secrets, use approved webhook or email destinations, and clear or protect the local logs if service names, internal hostnames, or outage details are sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documents and relies on shell-script execution (`check.sh`, `alert.sh`, `report.sh`) but does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: operators may approve or invoke the skill without realizing it can execute local commands and perform network actions via `curl`.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly supports sending alerts to external webhooks or email but does not warn users that monitored URLs, status codes, timing data, and error details may be transmitted to third parties. In environments where endpoint names or outage details are sensitive, this can cause unintended data leakage to external services.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The script writes the full target URL to a persistent log file on every success and failure. URLs can contain sensitive data such as query parameters, API keys, tokens, internal hostnames, or service identifiers, so storing them without sanitization or clear disclosure can leak operational and secret information to anyone with log access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.