ClawHub

Queue Task

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate local queue helper, but its task slug can escape the intended task folder and write queue state files elsewhere on disk.

Install only if you need a local file-backed queue helper and can control how task slugs are chosen. Use simple slug names without slashes or '..', set WORKSPACE_DIR to a directory you control, avoid running it with elevated privileges, and consider patching slug validation before relying on it for shared or automated workflows.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill documentation clearly instructs the agent to read and write task-folder state files such as `queue.jsonl`, `progress.json`, `done.jsonl`, `failed.jsonl`, `lock.json`, and `config.env`, but no explicit permissions are declared. That mismatch creates a real security issue because consumers may trust the manifest to reflect the skill's capabilities, while the skill can still modify persistent workspace state and configuration, increasing the risk of unintended file access or tampering.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal