ClawHub
Back to skill

Security audit

LLM Wiki

Security checks across malware telemetry and agentic risk

Overview

This is a local Markdown wiki helper that makes disclosed, scoped file updates and shows no evidence of hidden code, credential access, or data exfiltration.

Install this only when you want an agent to maintain a persistent local knowledge base. Keep sensitive documents out of `llm-wiki/raw/` unless you are comfortable with derived summaries and logs being written locally, and review planned file changes before accepting them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly states it will automatically create the folder structure and later update multiple files, but it does not present a prominent upfront warning about workspace modification before use. This can mislead users into invoking the skill without realizing it performs persistent writes, increasing the risk of unintended file creation, repository pollution, or accidental modification of important workspace content.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.