ClawHub
Back to skill

Security audit

Skill

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed LLM-based verification tool, but its documentation should be read carefully because one security statement understates that it can generate artifacts through provider calls.

Install only if you are comfortable running an npm CLI that uses your selected LLM provider key. Use a limited-scope or dedicated API key, review the generated artifact fields before trusting them, and treat the Security section's 'policy checks only' wording as incomplete rather than a full description of runtime behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The documentation contains a material contradiction about the tool’s behavior: earlier sections state that moltblock generates artifacts via LLM calls and returns fields such as draft, critique, and final_candidate, while the Security section claims it only analyzes task descriptions and does not generate artifacts. This can mislead operators into underestimating data exposure and output-handling risk, causing unsafe deployment decisions or inappropriate trust in the skill.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.