ClawHub
Back to skill

Security audit

NeuBird AI Production Ops Agent

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed wrapper for the NeuBird CLI to investigate production operations issues, with no bundled executable code or hidden install behavior.

Install this only if you trust NeuBird and the local neubird account's access to your production projects. Use least-privilege project access where possible, avoid sending secrets or unnecessary customer data in prompts, confirm the target project before running investigations, and clean up /tmp session files after use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill is scoped to nearly any production-related query, which can cause the agent to invoke an authenticated external operations CLI on vague or loosely related requests. In this context, broad triggering increases the chance of unnecessary access to sensitive production telemetry and of sending user prompts containing internal context to NeuBird without clear user confirmation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description says the skill can answer questions about production state, but it does not clearly warn that prompts and production context will be sent through the NeuBird CLI/service. This creates a transparency and data-handling risk because users may provide sensitive incident, infrastructure, or cost details without realizing they are being transmitted to a third-party tool.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.