ClawHub
Back to skill

Security audit

Neckr0ik Code Generator

Security checks across malware telemetry and agentic risk

Overview

This is a normal code-generation skill that writes scaffold files as expected, with no evidence of hidden exfiltration, persistence, or destructive behavior beyond generated-file workflows.

Install this only if you want a local boilerplate generator. Run it from a controlled project directory, choose output paths carefully, and review generated files before committing or running them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises commands that scaffold projects, generate files, and references a generator script, which implies file-write and likely shell execution capabilities, yet no permissions are declared. This creates a transparency and policy gap: users and enforcement systems are not clearly warned that the skill can modify the filesystem or invoke command-line tooling.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The command descriptions and options indicate generated scaffolds, CRUD code, configs, and tests will be written to an output directory, but the skill does not warn that existing files may be created, replaced, or overwritten. In a code-generation context this is operationally dangerous because users may run commands in the wrong directory or against existing repositories and unintentionally damage project files.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.