ClawHub

Agent Monitor

Security checks across malware telemetry and agentic risk

Overview

This skill openly monitors subagents and can send continuation messages, which matches its stated purpose but should be used carefully.

Install only if you want a tool that can monitor and nudge other agents. Test with --dry-run first, prefer --target or an allowlist for sensitive work, use longer thresholds for long-running tasks, and enable logging or review before scheduling automatic activation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description advertises broad monitoring and automatic activation behavior without narrowly defining when it should trigger, what agents it may affect, or what approvals are required. In an agentic environment, ambiguous trigger language can lead to overbroad autonomous actions, causing unintended interference with active tasks or repeated steering of agents without user awareness.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation promotes automatic agent activation but does not clearly warn that this causes autonomous operational effects, including sending messages to other agents and potentially altering execution flow. Without an explicit warning and consent model, operators may enable it without understanding that it can take action on their behalf and affect multiple running tasks.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. **Status Monitoring** - Real-time monitoring of agent runtime status
2. **Stall Detection** - Detecting "stalled" states where an agent has been unresponsive for over 5 minutes
3. **Automatic Activation** - Automatically sending activation messages to resume agent operation

## Core Capabilities
Confidence
92% confidence
Finding
Automatically send

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal