ClawHub
Back to skill

Security audit

Agent Sdd Bootstrap

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed OpenSpec/SDD setup helper; it can install a global npm package and modify project configuration, but those actions match its stated purpose.

Install this only when you intentionally want to initialize OpenSpec/SDD in a git repository. Review or commit current changes first, because the workflow can install a global npm package and overwrite or create project-level OpenSpec and agent configuration files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to call a user-input capability (`request_user_input`) that is not declared in `allowed-tools`. This creates an authorization/behavior mismatch: an executor may either fail unpredictably or substitute an unintended interaction path, which is risky in a workflow that also performs filesystem writes and bootstrap actions.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The activation description uses broad trigger phrases and loosely scoped usage conditions, making it easier for the skill to activate in projects where the user did not intend a full SDD/OpenSpec bootstrap. Because the skill includes installation commands and file overwrites, over-broad invocation increases the chance of unnecessary system changes or repository modifications.

Vague Triggers

Medium
Confidence
80% confidence
Finding
Stating applicability for 'any project' first-time SDD setup without constraints encourages execution across arbitrary repositories, despite the workflow making global installs, generating config, and overwriting project files. In context, this broad scope materially raises the risk of accidental modification of unrelated or sensitive projects.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.