ClawHub
Back to skill

Security audit

Workspace Explorer

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-built for remote workspace sharing, but it exposes a selected workspace through a public tunnel and relies on external code and binary downloads without enough scoping safeguards.

Install only if you intentionally want to give a trusted person live browser-based IDE access to a workspace. Review the external repository and start script first, serve the smallest sanitized directory possible, remove secrets and credentials, share the URL and password only with the intended recipient, and stop the tunnel as soon as the session is finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill’s invocation criteria are broad enough to trigger on ordinary requests to inspect files or browse a codebase, which can cause the agent to expose an entire workspace through a remotely accessible VS Code instance when a simpler, less risky file-sharing method would suffice. In this context, overbroad activation materially increases the chance of unnecessary external exposure of sensitive source code, credentials, or local artifacts.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill prominently describes creating a Cloudflare tunnel and printing a public URL and password, but it does not present a strong upfront warning that this exposes the workspace to Internet-accessible remote browsing and may reveal sensitive files, secrets, tokens, or proprietary code. Because the skill is user-invocable and designed for workspace-wide access, the lack of a clear risk warning makes accidental overexposure substantially more likely.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.