ClawHub
Back to skill

Security audit

Claude Installer

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly aligned with installing Claude Code remotely, but it asks for high-impact SSH and sudo actions while including contradictory and under-scoped installation guidance.

Review this carefully before installing. It is not clearly malicious, but it can run privileged commands on a remote machine, execute a downloaded setup script with sudo, change npm registry settings, and modify Claude configuration. Only use it on a machine you control, after reviewing each command and replacing the API-key setup and package-source choices with ones you trust.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The skill explicitly forbids `curl | bash` style execution but then instructs the agent to run `curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -`, which executes a remote script with elevated privileges. This creates a direct supply-chain and remote code execution risk on the target machine, especially because the script content is not reviewed or pinned by checksum before execution.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill says it does not modify system configuration, but it installs system packages with `sudo` and writes a persistent `~/.claude.json` file. These actions exceed the declared scope and can create trust and safety issues because the user is told the procedure is narrower than it actually is.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill says it does not modify system configuration, but it installs system packages with `sudo` and writes a persistent `~/.claude.json` file. These actions exceed the declared scope and can create trust and safety issues because the user is told the procedure is narrower than it actually is.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill directs the user to an unrelated external repository/tool (`cc-switch`) for API-key setup even though API configuration is outside the stated purpose of installing Claude Code. This expands trust to an unvetted third party and can expose users to phishing, credential theft, or malicious setup instructions.

Natural-Language Policy Violations

Medium
Confidence
85% confidence
Finding
The skill forces use of a China-specific npm mirror without user choice or strong justification. That changes the software supply path and trust boundary, increasing supply-chain risk if the mirror is outdated, compromised, or inappropriate for the user's environment.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:26