ClawHub

Security

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed remote safety-check CLI, with privacy considerations but no evidence of hidden execution, persistence, credential theft, or destructive behavior.

Install only if you are comfortable sending operation descriptions to a remote safety service. Avoid including secrets, tokens, private customer data, or full sensitive URLs in the input, context, or target fields, verify any SAFETY_API_URL override, and configure callers not to proceed silently when the check errors or returns a blocking decision.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
merged_env = os.environ.copy()
        if env:
            merged_env.update(env)
        return subprocess.run(
            [sys.executable, str(SCRIPT_PATH)] + args,
            capture_output=True,
            text=True,
Confidence
70% confidence
Finding
return subprocess.run( [sys.executable, str(SCRIPT_PATH)] + args, capture_output=True, text=True, env=merged_env, )

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This code sends the user-provided instruction, and optionally context and target, to an external HTTPS endpoint via `requests.post`. Although the module docstring mentions a safety API, the CLI help and runtime output do not clearly warn users that their input may be transmitted off-host, which is relevant for privacy and sensitive operational data.

External Transmission

Medium
Category
Data Exfiltration
Content
last_exc = None
    for attempt in range(1 + MAX_RETRIES):
        try:
            resp = requests.post(url, json=json_payload, timeout=timeout)
            if resp.status_code in (502, 503, 504) and attempt < MAX_RETRIES:
                time.sleep(RETRY_BACKOFF * (2 ** attempt))
                continue
Confidence
80% confidence
Finding
requests.post(url, json=

Env Variable Harvesting

High
Category
Data Exfiltration
Content
class TestSafetyContract(unittest.TestCase):
    def _run_cli(self, args, env=None):
        merged_env = os.environ.copy()
        if env:
            merged_env.update(env)
        return subprocess.run(
Confidence
60% confidence
Finding
os.environ.copy()

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## Core commands

```bash
python3 scripts/safety.py -i "Delete /tmp/cache/build-123.log" \
  -c '{"environment":"local-dev","operation_intent":"cleanup","scope":"single-resource","data_sensitivity":"internal","rollback":"easy","change_control":"none"}' \
  -t "/tmp/cache/build-123.log" --json
Confidence
80% confidence
Finding
Delete /tmp/cache/build-123.log

Tool Parameter Abuse

High
Category
Tool Misuse
Content
"recommendation": "review",
            },
        ):
            code, stdout, _ = self._run_main(["--input", "rm -rf /tmp/cache", "--json"])

        self.assertEqual(code, 0)
        payload = json.loads(stdout)
Confidence
100% confidence
Finding
rm -rf /tmp/cache", "--json"]) self.assertEqual(code, 0) payload = json.loads(stdout) self.assertTrue(payload["success"]) self.assertEqual(payload["data"]["approved"],

Tool Parameter Abuse

High
Category
Tool Misuse
Content
"recommendation": "review",
            },
        ):
            code, stdout, _ = self._run_main(["--input", "rm -rf /tmp/cache", "--json"])

        self.assertEqual(code, 0)
        payload = json.loads(stdout)
Confidence
95% confidence
Finding
rm -rf /tmp/

Tool Parameter Abuse

High
Category
Tool Misuse
Content
"risk_level": "high",
            },
        ):
            code, stdout, _ = self._run_main(["--input", "rm -rf /", "--json"])

        self.assertEqual(code, 1)
        payload = json.loads(stdout)
Confidence
95% confidence
Finding
rm -rf /"

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal