Security audit

Bomb Dog Sniff

Security checks across malware telemetry and agentic risk

Overview

This defensive scanner is mostly coherent, but it ships runnable malware-like test code and a powerful installer that should be reviewed before installation.

Install only after review. Prefer removing or converting the bundled malicious test fixtures into inert text fixtures before normal use, and run safe-install in an isolated environment because it downloads code and can modify existing installed skills.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (49)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code invokes `npx clawhub@latest download ...`, which executes package-management logic and fetches code from the network during a security-sensitive download path. Using `@latest` means the exact code being executed is mutable over time, so a compromised package, dependency, or registry response could lead to arbitrary code execution before the skill is even scanned.

Description-Behavior Mismatch

Critical

Confidence: 99% confidence
Finding: The file contains multiple concrete offensive functions, including wallet theft, credential exfiltration, reverse shells, remote code execution, scam messaging, and keylogging. For a skill described as a defensive scanner/quarantine tool, these capabilities are fundamentally inconsistent with its stated purpose and would enable full compromise of user systems and secrets if invoked.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The code attempts to access cryptocurrency wallet data, environment secrets, and local configuration, then transmit data to attacker-controlled endpoints. In the context of a security scanning skill, there is no legitimate need to harvest or export credentials, making this strongly indicative of credential theft and financial compromise.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The reverse shell and curl-pipe-bash backdoor patterns provide attackers with remote command execution and persistent compromise pathways. These are classic malware behaviors and are especially dangerous in a skill that may be installed with trust due to its security-themed branding.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The scam prompt solicits cryptocurrency transfers under false pretenses, and the keylogger captures keystrokes and sends telemetry externally. These features are unrelated to defensive scanning and directly facilitate fraud, privacy invasion, and credential theft.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The header comment claims the script is only for scanner validation, yet the code contains executable malicious behaviors that would run if imported or invoked. Mislabeling dangerous code as harmless test material increases the chance of accidental installation, review bypass, and social engineering success.

Description-Behavior Mismatch

Critical

Confidence: 99% confidence
Finding: The file implements multiple explicitly harmful behaviors including wallet theft, credential harvesting, reverse shells, keylogging, exfiltration, scam messaging, and persistence. This is radically inconsistent with the declared purpose of a defensive skill scanner, which makes the code highly dangerous in context.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The code launches classic reverse shell payloads through child_process.exec, enabling remote command execution and host takeover. A defensive scanning skill has no legitimate reason to open outbound shells, so this is clearly hostile functionality.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The function reads local configuration and extracts secrets from environment variables, which can expose API keys, tokens, and passwords. In a skill that claims to scan other skills safely, harvesting local credentials is unjustified and materially increases compromise risk.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The class records keystrokes and password-field input, then sends captured data off-host. Keylogging is credential theft behavior and is especially dangerous because it can capture passwords, wallet phrases, and other sensitive user input.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code displays a fraudulent payment prompt and replaces copied cryptocurrency addresses, facilitating direct financial theft. This behavior is incompatible with the declared security role and demonstrates active scam functionality.

Context-Inappropriate Capability

Critical

Confidence: 99% confidence
Finding: The code fetches remote shell scripts for execution and installs persistence via shell startup files and cron. This allows arbitrary attacker-controlled code execution and durable compromise across sessions.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The header claims the file is only for testing, but the program contains live harmful routines and invokes several of them from the main entry point. Misleading safety-oriented comments can reduce reviewer scrutiny and increase the chance of accidental execution.

Missing User Warnings

Medium

Confidence: 72% confidence
Finding: The documented safe-install workflow downloads content, moves files into the skills directory, creates backups, and deletes quarantined content on failure, but the user-facing warning is not prominent where the command is introduced. That can cause users to run a command with filesystem-modifying and destructive behavior without fully understanding the side effects.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: When `autoInstall` is enabled, the tool can replace an existing skill and may delete or rotate prior contents without an explicit confirmation prompt at the moment of installation. In a security tool, this increases the chance of accidental overwrite, downgrade, or replacement of trusted skills, especially if the scan produces false negatives or the source is malicious but scores below threshold.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This logic reads sensitive credentials and local configuration and exfiltrates them without any user consent or operational justification. The lack of warning is not the core problem; the behavior itself is credential theft and can lead to account takeover, cloud compromise, and downstream abuse.

Missing User Warnings

Critical

Confidence: 99% confidence
Finding: The subprocess execution of a bash reverse shell and the socket-based shell bridge give a remote operator interactive command execution on the host. In a defensive skill context, this is unequivocally hostile behavior and can result in total system compromise.

Missing User Warnings

Critical

Confidence: 99% confidence
Finding: Piping remote content from pastebin directly into bash is a textbook remote code execution pattern with no integrity verification or user approval. This allows arbitrary attacker-controlled code to run immediately on the system and is incompatible with a legitimate scanning tool.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The code captures keyboard events and transmits data to an external webhook, which is a keylogging/exfiltration pattern. In context, this is highly dangerous because it can capture secrets, credentials, and sensitive user input without notice.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The routine accesses wallet-related data and transmits it externally without any notice, consent, or legitimate operational need. In this context, lack of disclosure compounds what is already a credential-theft pattern.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Silent shell execution denies users any chance to prevent a host compromise and is especially dangerous because the commands are reverse-shell payloads. The absence of confirmation is not merely a UX flaw here; it masks active exploitation behavior.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The code silently reads a local config file and sensitive environment variables, exposing secrets without disclosure or need. In a defensive scanning skill, this hidden access is especially suspicious and dangerous.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The function decodes base64 and executes the result using eval and the Function constructor, concealing behavior from reviewers and security tools. Dynamic code execution is dangerous because it bypasses normal code review expectations and can run attacker-supplied logic.

Missing User Warnings

Critical

Confidence: 99% confidence
Finding: The code monitors keystrokes and password inputs and later exfiltrates them, all without consent or warning. This is a direct privacy and credential-compromise issue with high likelihood of account takeover and fraud.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The function sends arbitrary provided data to multiple external endpoints including DNS-style exfiltration, a webhook, and an ngrok tunnel with no user disclosure. This materially increases the chance that stolen or sensitive data leaves the environment undetected.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+2 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: safe-download.js:139

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/scan.js:286

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test-malicious-skill/scripts/malicious.js:32

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/malicious-skill/index.js:30

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/scan.js:81

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: test-malicious-skill/scripts/malicious.js:54

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: test/malicious-skill/index.js:65

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: test-malicious-skill/scripts/malicious.js:27

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: test/malicious-skill/index.js:46

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-malicious-skill/scripts/malicious.js:15

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test/malicious-skill/index.js:16

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: test-malicious-skill/scripts/malicious.js:53