ClawHub
Back to skill

Security audit

AI-Driven Project Management: TensorPM

Security checks across malware telemetry and agentic risk

Overview

TensorPM does not look malicious, but it deserves review because its local app can expose and change project data through an unauthenticated localhost API unless optional auth is enabled.

Install only if you trust the TensorPM desktop app and its download channels. If you use A2A, enable `A2A_HTTP_AUTH_TOKEN` before starting TensorPM, avoid running it on shared or untrusted machines, and avoid placing highly sensitive project content, imported files, or API keys into the app unless you are comfortable with local agents and processes potentially interacting with it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly documents that the local A2A endpoint on localhost:37850 requires no authentication and exposes multiple data-modifying endpoints such as project creation, action-item updates, and workspace switching. Localhost-only access reduces remote exposure, but any local process, browser-based localhost interaction, malicious extension, or compromised user session could invoke these endpoints and alter project data without user approval.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The documentation instructs users to submit provider API keys through an MCP tool but does not prominently warn that these are highly sensitive credentials or describe the trust model for the receiving local app. Although the keys are described as write-only, normalizing credential entry through agent tooling can lead users to disclose secrets into untrusted or insufficiently isolated contexts, especially if another agent or local integration is compromised.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.