Security audit

Nex Skillmon

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its monitoring purpose, but users should review it because it inventories installed skills, can send skill names to a remote API, and logs raw configuration values locally.

Review before installing in sensitive environments. Use a narrow skills directory, assume update/check commands may send installed skill names to ClawHub, and avoid storing tokens, passwords, or internal endpoints with the config command because values are stored and logged locally. Static scan was clean and VirusTotal was pending, so this is a Review decision based on artifact behavior rather than malware telemetry.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and requires access to environment variables, local files, network endpoints, and shell execution, yet it declares no explicit permissions. That mismatch weakens user consent and review because the skill can scan directories, read configuration from ~/.nex-skillmon/.env, contact external APIs, and invoke setup.sh without a clear permission model. In a monitoring skill that inventories other installed skills, this broad access is especially sensitive because it can expose metadata, secrets, and local system state across the whole skill ecosystem.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The `config` command allows callers to set any configuration key/value pair via `storage.set_config(args.set, args.value)` without restricting which settings are mutable. For a monitoring tool, this creates an unnecessary configuration-write primitive that could be abused to alter paths or other operational settings in ways that expand access, redirect scanning, or weaken security controls in downstream components.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger list includes generic phrases like "which skills," "skill health," and "API costs," which can overlap with normal conversation and cause the skill to activate unexpectedly. Because this skill performs broad scanning, security checks, and cost analysis over installed skills, accidental invocation could lead to unnecessary file enumeration, external API calls, or disclosure of local monitoring data in contexts where the user did not intend to run the tool.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code sends each installed skill's identifier to a remote ClawHub API in both update and security-flag checks, which leaks local inventory metadata off-host. Even if the purpose is legitimate monitoring, there is no disclosure, consent gate, or local-only mode in this file, so users may unknowingly reveal their installed skill set to a third party.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The set_config method logs both the configuration key and the raw value, which can expose secrets such as API keys, tokens, credentials, or internal endpoints to application logs. In a monitoring/security-oriented skill that aggregates operational data, logs are especially likely to be retained, exported, or viewed by multiple users, increasing the chance of sensitive configuration disclosure.

Static analysis

No suspicious patterns detected.