ClawHub
Back to skill

Security audit

Kanboard

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Kanboard API helper, but it can make powerful changes to a live Kanboard instance if given an Application API token.

Install only if you trust the Kanboard server and are comfortable giving the agent access to an Application API token. Use a dedicated token where possible, keep it secret, verify exact project/task/user IDs before changes, and require explicit confirmation before delete, disable, user-management, or permission-management actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill exposes irreversible operations such as removing projects, tasks, comments, users, columns, and subtasks without any built-in confirmation or safety guidance. In an agentic setting, this increases the chance of accidental or prompt-induced destructive actions against a live Kanboard instance, especially because the API token may have broad privileges and the Application API skips normal permission checks.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal