ClawHub
Back to skill

Security audit

Contribute Catalog

Security checks across malware telemetry and agentic risk

Overview

This skill is a public HyperFrames catalog contribution guide with expected preview publishing and PR steps, but users should be mindful before uploading work externally.

Install this only if you intend to contribute to the public HyperFrames catalog. Before running publish, upload, push, or PR commands, review the files and preview assets for sensitive content, confirm the remote targets, and only use the AWS upload step if you are an authorized HeyGen internal contributor.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the user to publish project content to a public preview service (`npx hyperframes publish`) but does not warn that local project assets, metadata, and potentially sensitive work-in-progress content will be uploaded to an external service. In a contribution workflow this can cause unintended disclosure, especially if the contributor runs the command from a repo containing unreleased or proprietary material.

Missing User Warnings

Low
Confidence
91% confidence
Finding
The PR workflow tells the user to push a branch and create a GitHub PR containing a public preview link without clearly warning that repository contents and metadata will be transmitted to remote services. While expected in an upstream contribution flow, the missing disclosure can still lead to accidental publication of code or assets the user did not intend to share.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.