ClawHub
Back to skill

Security audit

Gitea Repo Ingest

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does what it says, but it may read and pass through secret-bearing .env files from repositories during ingestion.

Install only for repositories you are comfortable having analyzed by OpenClaw and summarized into the team KB. Avoid running it on repos that may contain committed secrets, or update the sampler to exclude and redact .env, key, credential, and token files before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill directs the agent to use shell, network, environment variables, and file read/write operations against local payloads, cloned repositories, and the team knowledge base, yet no explicit permission declaration is present. In an agent environment, this creates a capability-transparency gap: reviewers and policy engines may not realize the skill can access tokens, clone remote content, and modify persistent files, increasing the risk of over-privileged execution or unintended data exposure.

Credential Access

High
Category
Privilege Escalation
Content
}

TEXT_EXTENSIONS = {
    ".c", ".cc", ".cfg", ".clj", ".cpp", ".cs", ".css", ".dockerfile", ".env",
    ".go", ".gradle", ".graphql", ".h", ".hpp", ".html", ".java", ".js", ".json",
    ".jsx", ".kt", ".lock", ".md", ".mjs", ".php", ".properties", ".py", ".rb",
    ".rs", ".rst", ".scss", ".sh", ".sql", ".swift", ".toml", ".ts", ".tsx",
Confidence
91% confidence
Finding
The sampler explicitly treats '.env' files as readable text and may collect their contents from cloned repositories into 'samples', which are then returned in context for downstream processing. In a repo-ingestion skill, this is dangerous because public and private repositories often contain accidentally committed secrets, and this design increases the chance of secret disclosure into logs, model prompts, KB pages, or other persistence layers.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.