ClawHub
Back to skill

Security audit

Envcheck

Security checks across malware telemetry and agentic risk

Overview

This is a small local readiness checker that reports whether named environment variables and command-line tools exist, without reading secret values or making unrelated changes.

Install only if you want a local pre-flight environment checker. Keep the uvicorn service bound to localhost or otherwise protected, because callers can learn whether specific environment variable names and binaries exist even though secret values are not disclosed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill inspects environment variables and CLI availability, which is a form of environment access, but it declares no corresponding permissions or trust boundary information. That mismatch can mislead users and higher-level tooling about what the skill observes, increasing the risk of unreviewed disclosure of local system state.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.