ClawHub
Back to skill

Security audit

Sysclaw Ops

Security checks across malware telemetry and agentic risk

Overview

This skill is a real operations workflow for a privileged SysClaw agent, but it needs review because it can automatically change databases and run SSH actions on infrastructure.

Install only on the intended SysClaw operator agent, not on a general assistant. Before enabling the cron or heartbeat workflow, add exact worklog grants, restrict DB and SSH roles, define allowed hosts and commands, verify request identity, require human confirmation for any state-changing action, and monitor the recurring job.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
86% confidence
Finding
The documented workflow performs INSERT/UPDATE operations on a worklog table that is operationally required for execution tracking, but that dependency is outside the declared minimal privilege scope. This mismatch can cause operators to broaden database privileges ad hoc or run the skill with a more privileged role than intended, weakening least-privilege controls and audit assumptions.

Scope Creep

High
Confidence
97% confidence
Finding
The skill says worklog writes are part of normal processing, but the stated minimal DB privileges omit any permissions for that table. In practice, this encourages privilege creep, failed partial workflows, or operators granting broader rights than necessary so the automation works, which can expose sensitive execution data and expand write capability beyond the intended tables.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger phrases are broad enough to match ordinary operational language such as reviewing requests or checking notifications, which can invoke a high-impact skill unintentionally. Because this skill can lead to database updates, SSH actions, and escalation processing, accidental activation increases the risk of unintended administrative operations.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill description and operating instructions do not prominently warn that approval can result in SSH-based changes and database state mutations. That omission can mislead operators about the consequences of invoking the skill, increasing the chance of unsafe use in contexts where only review was intended.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.