ClawHub
Back to skill

Security audit

Qoder CLI skill

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill is not malicious, but it needs review because it normalizes permission-bypassing and broad third-party tooling around an authenticated coding CLI.

Install only if you trust the `qodercli` binary and are comfortable letting it operate on your codebase using your Qoder account. Avoid `--yolo` except in isolated, non-sensitive workspaces, review any MCP server before adding it, and be careful in shared sessions where others may influence prompts run under your token.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill states that Qoder CLI only accesses the specified workdir, but elsewhere it explicitly relies on home-directory files such as ~/.qoder/settings.json, ~/.qoder/AGENTS.md, ~/.qoder/agents, and inherited authentication environment variables. This is a misleading security claim that can cause users to underestimate the actual trust boundary and unintentionally expose credentials, configuration, or data outside the project directory.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation actively recommends `--yolo` to skip permission checks and presents it as a normal usage pattern without a strong warning about the consequences. In a coding agent that can edit files, run commands, and use subagents, normalizing permission bypass materially increases the chance of destructive or privacy-impacting actions occurring without review.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill highlights automatic inheritance of `QODER_PERSONAL_ACCESS_TOKEN` and shell environment authentication as seamless behavior but does not clearly warn that delegated tasks may gain access to sensitive tokens or environment-based secrets. This is especially risky in multi-session, shared-workspace, or externally influenced task contexts where users may assume isolation.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.