ClawHub
Back to skill

Security audit

Statichub

Security checks across malware telemetry and agentic risk

Overview

This skill has a clear static-site deployment purpose, but it tells the agent to install its CLI by running an unverified remote shell script.

Review or replace the CLI installation step before using this skill. Prefer installing StaticHub through a trusted package manager or a pinned, verified release, and deploy only files you intend to make public.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to install missing tooling by piping a remotely fetched script directly into `sh` without any user warning, integrity check, pinning, or review step. This creates a direct remote code execution path: if the upstream repository, network path, or referenced script is compromised, arbitrary shell commands would run on the user's machine.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.