ClawHub

Credential Scanner

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward local secret-scanning skill, but its reports should be treated as sensitive.

Install only if you intend to let the skill inspect the project or folder you ask it to scan. Keep generated reports private, avoid committing them or uploading them to shared CI artifacts, and rotate any real credentials it finds.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill advertises scanning arbitrary files, directories, and repositories and saving reports, which implies file read and file write capabilities, but it does not declare any permissions or constraints. This creates a transparency and least-privilege problem: an agent may invoke filesystem access broader than users or reviewers expect, increasing the risk of over-collection of sensitive data and unintended writes.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The tool writes scan results to any user-supplied output path, and those results include sensitive metadata such as repository file paths, line numbers, and partially masked secret values. While this is expected functionality for a scanner, writing such reports without warning or safer defaults can unintentionally leak sensitive information into shared locations, CI artifacts, or world-readable files.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal