ClawHub

Resilience Monitor

Security checks across malware telemetry and agentic risk

Overview

The skill appears to provide a local resilience monitoring dashboard, with minor transparency and trigger-scope issues but no evidence of malicious behavior.

Install only if you want a local dashboard for resilience/error monitoring. Avoid opening it during screen sharing or on shared machines, and prefer explicit commands such as opening the resilience dashboard rather than generic monitoring phrases.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Low
Confidence
83% confidence
Finding
The skill explicitly provides a tool that opens a browser-based dashboard showing operational error statistics and retry management, but it does not clearly warn users that invoking the tool will launch a local web UI and expose potentially sensitive operational metadata on screen. While the UI is bound to localhost, this can still leak model names, error logs, and recovery details to anyone with local access or through screen sharing, so the omission is a real but low-severity transparency and privacy issue.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The dashboard-opening examples are very broad and map common phrases like '打开监控面板' or '打开错误统计页面' directly to an action that opens a dashboard. This increases the chance of unintended invocation from ambiguous user speech or unrelated monitoring requests, causing unauthorized or surprising navigation/actions within the agent context.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal