Security audit
clawdo - Todo List for Agents
Security checks across malware telemetry and agentic risk
Overview
clawdo is a disclosed agent task-list CLI with persistent local task storage and no artifact evidence of hidden or malicious behavior.
Install only if you are comfortable with a global npm CLI maintaining a persistent local task queue. Keep unattended heartbeat or cron use limited to clearly scoped, pre-approved, low-risk tasks, and require human review for work involving production systems, accounts, money, credentials, public content, or private data.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.