ClawHub

Muguozi1 Openclaw Git Helper

Security checks across malware telemetry and agentic risk

Overview

This is a simple Git helper skill whose risky parts are ordinary Git actions, not hidden or unrelated behavior.

Install only if you want Git workflow help. Before using mutating actions such as pull, push, checkout, merge, rebase, or branch deletion, review git status and diffs and require explicit approval, especially in shared or production repositories.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill advertises shell-capable behavior through documented git commands, but it does not declare any permissions or safety boundaries for executing those operations. This can cause an agent or user to invoke repository-affecting commands without an explicit trust/approval model, increasing the risk of unintended command execution in sensitive workspaces.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill documents repository-changing actions like push and branch management without warning that these commands can modify local or remote state. In an agent context, missing cautionary language makes it more likely that destructive or irreversible git operations are performed without user awareness, especially in production or shared repositories.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal