ClawHub
Back to skill

Security audit

local-coding-orchestrator

Security checks across malware telemetry and agentic risk

Overview

The skill appears coherent and disclosed, with one Windows script-running safety caveat users should understand before use.

Before installing or following the playbook, review the referenced PowerShell scripts and only run the bypass command for code you trust. Prefer a normal PowerShell execution path if it works in your environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The playbook explicitly instructs operators to run PowerShell with `-ExecutionPolicy Bypass`, which suppresses a built-in safeguard intended to reduce accidental execution of untrusted scripts. In a skill that orchestrates local coding workflows and launches helper scripts, normalizing this pattern increases the chance that users execute modified or malicious local scripts without realizing the security implications.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.