ClawHub
Back to skill

Security audit

04 Agent Stack Audit

Security checks across malware telemetry and agentic risk

Overview

This audit skill is coherent but needs review because it asks for broad access to automations, API/subscription data, and memory files, and it allows a script-editing exception.

Install only if you are comfortable letting the agent inspect broad parts of your automation stack. Before running it, define exact directories, cron sources, accounts, API inventories, subscription records, and memory files that are in scope; require secrets to be masked in reports; and do not allow cleanup or script edits unless you explicitly approve a diff and have a rollback path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill is presented as an audit/reporting workflow, but its execution rules expand scope into making code changes by commenting out calls in certain cases. That creates a mismatch between expected read-only analysis and actual write capability, which can lead to unauthorized or accidental modification of operational scripts during what users may believe is a non-destructive review.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The rule says nothing should be deleted without explicit approval, but then introduces an exception allowing script modification without that approval. Even though the exception is narrower than deletion, it still permits altering code paths autonomously, undermining the stated safety boundary and increasing the chance of service disruption or unintended behavior.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The top-level description frames the skill as producing a cleanup brief for review, but it does not clearly disclose that later phases may modify files after approval or under an embedded exception. This incomplete disclosure can cause users to authorize the skill under a mistaken assumption that it is purely analytical, reducing informed consent around potentially destructive actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.