ClawHub
Back to skill

Security audit

Phy Schema Sleuth

Security checks across malware telemetry and agentic risk

Overview

This is a text-only schema helper that does not install code or request system access, but users should avoid pasting sensitive real data into it.

Installers should treat this as low risk, but should redact secrets, tokens, customer records, internal URLs, and other confidential data before using it. Review generated schemas before production use because type inference from small samples can be incomplete or wrong.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrases include very broad natural-language patterns such as 'generate schema', 'generate types', and 'what's the schema for this', which are common in ordinary developer conversations. This can cause unintended invocation of the skill on unrelated prompts, increasing the chance that users accidentally route sensitive content into the skill or receive schema-generation behavior when they did not explicitly request it.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly encourages users to paste raw sample data from JSON, CSV, API responses, and other sources, but provides no warning to sanitize secrets, credentials, personal data, or regulated information first. In practice, sample payloads often contain tokens, emails, IDs, internal URLs, or customer records, so this design increases the likelihood of inadvertent sensitive data exposure during use.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.