ClawHub
Back to skill

Security audit

Filament Vault

Security checks across malware telemetry and agentic risk

Overview

Filament Vault is a local inventory tracker that stores user-entered filament details in a clearly disclosed JSON file and shows no hidden network, credential, or destructive behavior.

Before installing, be aware that filament costs, storage locations, and free-text notes are stored locally in plain JSON. Do not put sensitive personal information in the notes field on a shared machine.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill performs local file reads and writes to a JSON inventory file, but it does not declare any permissions to inform or constrain that behavior. This creates a transparency and policy-enforcement gap: users or hosting systems may treat the skill as less privileged than it actually is, while the documented commands can modify persistent data under the user's home directory.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal