ClawHub
Back to skill

Security audit

Skills

Security checks across malware telemetry and agentic risk

Overview

This documentation-only skill exposes external human-review workflows that are disclosed and aligned with its stated purpose.

Install this only if you want an agent to send work to SanctifAI and potentially to external human reviewers. Do not include secrets, credentials, regulated personal data, or confidential files unless you are authorized to share them; prefer guild or direct routing for trusted reviewers, verify invite recipients and callback URLs, and protect SanctifAI API keys and webhook secrets like account credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill is explicitly designed to send prompts, task details, and human responses through an external service and onward to external humans, but it does not prominently warn that sensitive, proprietary, or personal data may be disclosed outside the agent's trust boundary. In a human-in-the-loop workflow, this omission can cause accidental privacy breaches because users may assume content stays within the agent or API provider rather than being exposed to third-party workers.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The attachment feature encourages uploading files for worker reference but does not warn that uploaded document contents may be exposed to external human workers. This increases the risk of accidental disclosure of secrets, internal documents, customer data, or regulated information because attachments often contain far more sensitive material than short task descriptions.

External Transmission

Medium
Category
Data Exfiltration
Content
# Pick: task_type="EVA", domain="RES", use_case="verification"

# Step 2: Create a research verification task
task = requests.post(f"{BASE_URL}/tasks", headers=headers, json={
    "name": "Verify Research Finding",
    "summary": "Confirm this statistic before publishing",
    "target_type": "public",
Confidence
90% confidence
Finding
requests.post(f"{BASE_URL}/tasks", headers=headers, json=

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.