ClawHub
Back to skill

Security audit

More Trees

Security checks across malware telemetry and agentic risk

Overview

The skill mostly fits a More Trees integration, but it under-discloses a tree-planting action that can change account state or consume credits.

Review this skill before installing. It can read More Trees account/project data and may also plant or gift trees through the connected account, possibly using credits. Only use it if you are comfortable requiring explicit confirmation for plant_trees until the skill clearly marks it as a write action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest and description frame the skill as only for searching and reading data, but the documented actions include `plant_trees`, which performs a real state-changing operation. This mismatch can mislead agents or users into invoking the skill under read-only assumptions, increasing the risk of unintended purchases or account actions.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The safety section says untagged actions are reads, yet `plant_trees` is listed without the promised `[write]` tag despite changing account state. An agent relying on the documented convention could treat `plant_trees` as safe to run directly, causing unauthorized tree purchases, gifting, or credit consumption.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The invocation guidance says to use this skill for ANY More Trees request, which is overly broad and may cause the agent to route ambiguous mentions to this skill automatically. In context, that broad trigger is more dangerous because the skill includes a hidden write capability, so accidental invocation could lead to unintended state-changing actions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.