ClawHub

Kairoa Toolkit

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed launcher/reference skill for the Kairoa desktop utility app, with caution needed around sensitive inputs and network tools.

Install Kairoa only from a source you trust. Do not put real passwords, API keys, private keys, seed phrases, tokens, or sensitive account data into kairoa:// URLs; enter secrets only through trusted secure app flows. Use port scanning, traceroute, TLS checks, and similar tools only on systems you own or are authorized to test.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill includes a deep-link example that places a plaintext password directly into a custom URL. Even if shown as an example, this encourages users or downstream agents to pass secrets via command line and URL handlers, which can expose them through shell history, process listings, logs, desktop telemetry, or application-level URL handling.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The skill advertises network and security features such as DNS lookup, port scanning, traceroute, TLS checking, WebSocket testing, and password vault functionality without any usage constraints or privacy notice. This can lead an agent or user to submit internal hosts, credentials, certificates, or other sensitive targets to a desktop app without understanding scanning impact, authorization requirements, or data handling risks.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal