ClawHub
Back to skill

Security audit

V19 Certified Agent Workflow

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-aligned, but it asks users to send registration data and an API key to third-party web services without enough privacy or credential-handling detail.

Review carefully before installing. Only use it if you trust the publisher and the dashboard domain, avoid submitting secrets or proprietary metadata, and use a dedicated low-privilege API key that can be revoked or rotated quickly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs users to send requests and registration data to an external Cloudflare-hosted service, but provides no privacy notice, data retention statement, or warning about what information may be collected and linked to the user's agent identity. In a security-sensitive agent workflow, encouraging outbound transmission without transparent handling terms increases the risk of unintended data disclosure and unsafe trust in a third-party governance service.

Missing User Warnings

High
Confidence
99% confidence
Finding
The documentation tells users to enter their API key into a remote dashboard website, but gives no guidance on credential scope, storage, transport, or whether the site is trusted to handle sensitive secrets. This creates a phishing-like credential capture risk, especially because the skill heavily emphasizes certification, trust scores, and audit claims that could lower user skepticism.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.