ClawHub
Back to skill

Security audit

StorageSaver

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Mac disk-usage watcher with scheduled alerts, but users should treat its optional notification command as powerful.

Install only if you are comfortable with a tool scanning local storage metadata and keeping reports under ~/.config/storagesaver. Do not set NOTIFY_CMD to anything you would not run yourself, and remember that emailed or uploaded reports may expose private file paths and storage details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a read-only disk-watching helper, but the documentation introduces materially broader capabilities: executing osascript, invoking external tooling, persisting reports, and especially running an arbitrary shell command from NOTIFY_CMD. That mismatch can cause operators or users to trust and deploy the skill with insufficient scrutiny, enabling command execution and data disclosure beyond the stated purpose.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
Allowing NOTIFY_CMD to be any shell command creates a direct arbitrary command-execution surface in a skill whose core function is only to monitor disk usage and emit alerts. If an attacker can influence configuration, environment variables, scheduling, or deployment wrappers, they can execute commands and potentially exfiltrate the generated HTML report or other local data.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The script claims to be read-only, but `notify()` executes `NOTIFY_CMD` via `/bin/sh -c`, which allows arbitrary shell execution in the watcher's security context. If an attacker can influence the environment or scheduler configuration, they can run arbitrary commands despite the skill's safety claims.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
watcher.js:126