ClawHub

Qjzd Nav Cli Operations

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only skill for managing QJZD Nav backups and settings, with disclosed commands that can change or delete site data.

Install only if you already trust and use the qjzd-nav CLI. Before running commands that delete backups, import backup data, update site settings, or upload local files, confirm the target site and exact file or setting involved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents a destructive backup deletion command without any cautionary language, confirmation guidance, or recommendation to verify the target filename first. In an agent-executed or automation context, this increases the chance of accidental irreversible data loss, especially because backup deletion removes recovery points rather than just transient data.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The import command is presented as a routine operation without warning that importing a backup can overwrite or materially alter current site configuration and content. In a CLI skill intended for operational use, this omission makes accidental restoration into the wrong environment or loss of current state more likely.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal