ClawHub
Back to skill

Security audit

Roboflow

Security checks across malware telemetry and agentic risk

Overview

The skill is a legitimate Roboflow connector, but it under-describes workflow and inference execution as read-only behavior that can run through a connected account.

Review before installing if you want strict control over Roboflow account activity. Treat workflow runs, saved workflow runs, and object detection as execution actions that may process sensitive inputs or consume service resources, and require explicit user intent before running them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest says the skill is for 'searching and reading data,' but the documented actions include workflow execution operations such as `run_workflow` and `run_saved_workflow`. This mismatch can cause an agent or user to treat the skill as read-only and invoke execution-capable actions without the higher scrutiny normally applied to non-read operations.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The safety section states that untagged actions are reads, but the untagged action list includes `run_workflow` and `run_saved_workflow`, which execute workflows and may trigger computation, external effects, or processing of sensitive inputs. Misclassifying execution as read-only materially increases the chance of unsafe automatic invocation.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The instruction to use this skill for 'ANY Roboflow request' is overly broad and encourages routing all Roboflow-related tasks through a single skill regardless of operation type or risk. In context, that broad trigger is more dangerous because the skill includes non-read capabilities, increasing the chance of overuse or invocation in situations where narrower, safer handling is warranted.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.