ClawHub
Back to skill

Security audit

Cnexus2.0

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local personal-memory app guide, with privacy and data-loss caveats around stored memories and one-click clearing but no artifact-backed malicious behavior.

Before installing, decide whether you are comfortable with a local app retaining conversations, documents, and ingested material in a JSON state file. Review the upstream GitHub runtime before running python app_v2.py, avoid storing secrets unless you understand the storage model, and back up anything important before using the clear-memory feature.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly advertises automatic persistence of personal conversation and document data and a one-click memory clearing feature, but it does not warn users that sensitive data will be retained on disk or that clearing may be destructive and irreversible. In a 'personal second brain' context, users are especially likely to store sensitive material, so missing disclosure meaningfully increases privacy and data-loss risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.