ClawHub
Back to skill

Security audit

Skill

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed OneMind service integration that can create an anonymous participant and submit chat content or ratings, with no hidden installer or unrelated local access.

Install only if you want your agent to contact OneMind and participate in a live shared consensus chat. Use a pseudonymous display name, avoid private or sensitive proposition text, and confirm before letting the agent join chats or submit ratings because those actions can change external service state.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill gives concrete commands for POST-based actions that create participants, submit propositions, and submit ratings on the external OneMind service, but it does not clearly warn that these are state-changing operations. In an agent setting, this can cause unintended external side effects such as account creation, chat participation, or content submission without informed user consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:43