ClawHub
Back to skill

Security audit

Heartbeat

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Heartbeat read/search connector with some broad CLI flexibility that users should keep scoped to the listed read actions.

Install only if you are comfortable letting the agent read Heartbeat community data through your connected OOMOL account. Keep usage to the listed get/list/search actions, and require explicit confirmation before any new, write, or destructive Heartbeat action is run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest and description position the skill as limited to searching and reading data, but the execution guidance allows the agent to inspect any live Heartbeat action schema and invoke arbitrary actions via `oo connector run`. That mismatch can cause an agent or user to trust the skill as read-only while it is technically capable of performing writes if the connector exposes them, creating a privilege/scope confusion vulnerability.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The safety section asserts that untagged actions are reads, but the operative workflow tells the agent to trust the connector's live schema and run actions based on arbitrary action names. If new or undocumented actions are exposed by the connector, the agent may execute state-changing operations without recognizing them as writes, bypassing the intended safety model.

VirusTotal

45/45 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.