ClawHub

Summarize

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward summarization tool that only reads a chosen file or fetches a chosen URL, with ordinary privacy cautions for sensitive files and links.

Install if you want a local CLI summarizer, but treat file paths and URLs as deliberate inputs: do not summarize secrets or private files unless you intend their contents to be processed, and do not fetch internal or sensitive URLs in environments where outbound requests are monitored or restricted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises local file summarization and automatic webpage fetching, which imply file-read and network-access capabilities, but it does not declare any permissions or trust boundaries. This can mislead users and hosting platforms about what the skill may access, reducing transparency and increasing the risk of unintended local data exposure or outbound requests.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The markdown states that a provided URL will be automatically fetched and summarized, but it gives no warning that this causes a network request to an external site. Users may unknowingly trigger requests that reveal browsing targets, internal URLs, or sensitive endpoints, especially if the skill is used in enterprise or agentic environments.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal