ClawHub
Back to skill

Security audit

no-local-gguf-workspace

Security checks across malware telemetry and agentic risk

Overview

This skill is a documented workspace rebuild runbook that discloses its use of existing API keys and external model providers, with no hidden executable payload in the package.

Install only if you intend this agent to rebuild the named workspace and answer through the configured external model providers. Review the local router and credential files first, because prompts may leave the machine and existing API keys will be used.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill directs a full workspace rebuild and explicitly routes final answers through external model API providers, but it does not require user confirmation or warn that prompts, workspace-derived context, or other potentially sensitive data may be transmitted off-host. In an agent skill, this is risky because the automation can make broad system changes and exfiltrate data to third-party services under the guise of normal operation.

Credential Access

High
Category
Privilege Escalation
Content
- Sets `SKIP_LOCAL_MODELS=1` and `ENSURE_SKIP_LLAMA_BUILD=1` before `ensure_workspace.sh`.
- Confirms llama.cpp is absent and `out/models/` contains no `.gguf` files.
- Routes every final answer through `tools/router.py` using only stored keys in `secrets/api_credentials.json`.
- Marks self_grade T1–T5 as expected FAIL and T6–T12 as the real health gate.
- Stops TDAI containers before any torch-class Python import on the 2 GB sandbox.
Confidence
90% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
## 🔐 Permissions / requirements

- Reads `/home/user/ensure_workspace.sh`, `/home/user/tools/router.py`, `/home/user/secrets/api_credentials.json`.
- Runs `bash`, `python3`, and optionally `docker` via `tools/start_tdai.sh`.
- Does **not** request new API keys. Uses only keys already stored in the private workspace secret store.
- Network: outbound calls only to providers already listed in `tools/router.py` when answering questions.
Confidence
94% confidence
Finding
credentials.json

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.