ClawHub
Back to skill

Security audit

Operately CLI

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Operately CLI guide, but users should be careful with credentials and destructive admin commands.

Install this only if you want an agent to operate an Operately workspace through the official CLI. Prefer API-token login or secure secret injection over password flags, confirm the target base URL/profile before changes, and require explicit confirmation before deleting members, admins, spaces, documents, or changing permissions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill includes multiple examples of password-based authentication using inline command flags, which encourages entering credentials directly on the command line. Command-line passwords are commonly exposed through shell history, process listings, audit logs, transcripts, and agent telemetry, making credential leakage significantly more likely in automated or shared environments.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The file documents destructive company-level commands such as deleting admins and members without adjacent warnings, confirmation guidance, or safer alternatives. In a CLI skill intended for operational automation, this increases the chance of accidental privilege removal or user lockout, especially if an agent or operator copies examples directly into production workflows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.