ClawHub
Back to skill

Security audit

RFC Document Assistant

Security checks across malware telemetry and agentic risk

Overview

This is an RFC lookup helper that depends on the external x-cmd CLI, with the installation risks disclosed rather than hidden.

Install this only if you are comfortable using the external x-cmd CLI. Prefer Homebrew or manual script review, and avoid the curl-to-shell installer on machines with sensitive data unless you explicitly accept that supply-chain risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The file content is for installing and managing x-cmd, not for querying RFC documents as promised by the x-rfc skill metadata. This mismatch is dangerous because it broadens the skill's operational scope from harmless document lookup to software installation and shell execution, increasing the chance an agent performs risky actions under a misleading label.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The guide introduces remote download and code-execution workflows that are not justified by an RFC lookup skill. In this context, even documented warnings do not eliminate the risk, because an agent may still be induced to fetch and run code when the user only requested standards information.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.