ClawHub
Back to skill

Security audit

maya-umbrella-batch-antivirus

Security checks for vulnerabilities and agentic risk

Overview

This skill is a purpose-built Maya scene malware scanner and cleaner that discloses its download, install, scan, cleanup, backup, and approval requirements.

Before installing, confirm the exact GitHub release version, checksum asset, and LOCALAPPDATA install destination. For cleanup, review the scan report, affected file list, source hashes, backup behavior, and Maya version before giving explicit approval, because cleaned scenes are saved in place.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The script performs HTTP downloads from GitHub using Invoke-WebRequest, which is a network operation that transmits system metadata such as the user's IP and request headers. While the code is security-conscious, there is no confirmation prompt or user-facing notice before the network access occurs; the only visible output is the final JSON on success or an error on failure.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The script creates product and version directories and later writes downloaded artifacts, extracted contents, and the final installation under the user's LOCALAPPDATA path. Although this is expected for an installer, the script provides no visible notice to the user about where files will be placed; absent README context, there is no in-script disclosure of this filesystem impact.

Static analysis

No suspicious patterns detected.