ClawHub
Back to skill

Security audit

mlops-engineer

Security checks across malware telemetry and agentic risk

Overview

This MLOps guidance skill is coherent and instruction-only, but its examples should be reviewed before use in real ML or cloud environments.

Reasonable to install as a guidance skill. Treat generated CI/CD, Kubernetes, AWS, MLflow registry, Kubeflow, and feature-store snippets as change proposals: verify targets, credentials, approvals, rollback plans, and artifact provenance before running them against production or shared systems.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The examples include code and configuration that performs side-effecting actions such as writing local files, connecting to MLflow and Kubeflow endpoints, creating pipeline runs, materializing features, deploying infrastructure, and applying Kubernetes manifests, yet the markdown does not warn users that copying these snippets can trigger real network, deployment, and filesystem operations. In an MLOps skill, users are especially likely to run examples in connected production-like environments, which increases the chance of accidental model registry changes, infrastructure modification, artifact leakage, or unintended jobs against live services.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.