ClawHub

Paper to Pipeline

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward machine-learning code generator that reads a user-provided plan and writes a local project, with no evidence of hidden data access or malicious behavior.

Install this only if you want a local ML pipeline generator. Use a new empty output directory, review generated Python before running it, and expect package installation or pretrained model downloads if you execute the generated project.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill explicitly reads uploaded experiment documents and generates a multi-file project on disk, which are file read/write capabilities, yet no permissions are declared. This creates a trust and policy gap: users and the platform may not realize the skill can access inputs and persist generated artifacts, increasing the chance of unintended file access or unsafe writes.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill describes code generation but does not clearly warn users that it will create and write a runnable multi-file project to disk. In a code-generating context, silent artifact creation can surprise users, lead to overwriting files, or cause unsafe downstream execution of generated code that users did not expect to be materialized locally.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal