ClawHub
Back to skill

Security audit

Hugging Face

Security checks across malware telemetry and agentic risk

Overview

This Hugging Face connector is mostly coherent, but it under-discloses generation actions and tells agents that untagged actions are safe reads even though some can send data to inference services.

Review this before installing if you expect a read-only Hugging Face helper. Generation and embedding calls should be treated as external inference operations, not simple reads; confirm prompts, input text, target model/provider, and possible account or billing impact before running those actions. The clean VirusTotal and static scan results reduce malware concern, but they do not fix the documentation mismatch.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest and description frame the skill as only for searching and reading data, but the documented actions also include `generate_chat_completion` and `generate_embeddings`, which are active inference operations rather than simple reads. This mismatch can mislead higher-level agents or users into applying weaker safety assumptions, causing unintended execution of non-read actions under a supposedly read-only skill.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The safety section states that untagged actions are reads and safe to run directly, yet untagged actions include generation operations such as chat completion and embeddings. This creates an unsafe trust boundary: an agent may auto-run these actions without confirmation because the documentation incorrectly classifies them as harmless reads.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.