ClawHub
Back to skill

Security audit

npm

Security checks across malware telemetry and agentic risk

Overview

This npm helper is disclosed as an OOMOL-backed read/search connector and does not show hidden, destructive, or unrelated behavior.

Install only if you are comfortable using OOMOL as the intermediary for npm lookups and connecting an npm API key to that service. Review the live action schema before use, and require explicit approval before any future write or destructive npm action is run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill explicitly says to use it for ANY npm request, which creates an overly broad routing rule with no scope limits or exclusions. That can cause the agent to invoke this skill for sensitive or unintended npm-related tasks, increasing the chance of unnecessary external calls and reducing opportunities for finer-grained policy checks.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.