ClawHub
Back to skill

Security audit

Lingxi · Agent Health Monitor

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent agent health monitor, but it asks for automatic session cleanup, cache clearing, provider switching, and history pruning without enough user control or retention detail.

Review this before installing if you rely on session history or stable tool/provider behavior. Configure self-healing and cleanup conservatively, define a retention policy, and require confirmation before deleting or pruning session data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger command "Alert me if..." is a common everyday phrase and is not scoped to a specific product, context, or command surface. This broad wording increases the chance of unintended invocation because the document does not provide exclusions, constraints, or negative examples.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The markdown states that the agent can automatically restart connections, clean up sessions, flush memory cache, retry tool calls, and switch providers. These actions can affect user data, task execution, or system behavior, but the skill description does not clearly warn users about the impact or conditions under which these automatic remediations occur.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The document says the skill may archive session summaries, merge memory files, and prune session history beyond a retention limit. These behaviors can alter or remove stored user-related data, but the description does not warn users about retention, possible loss of detail, or how pruning decisions are made.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.