ClawHub
Back to skill

Security audit

supervisor-config-gen

Security checks across malware telemetry and agentic risk

Overview

This skill is a small, disclosed helper for generating a local Supervisor config, with ordinary install and file-write risks that users should review.

Before installing, review the GitHub script you download, prefer the current-user install unless all users need it, and check for an existing generated config before running because it overwrites that file. Review the generated Supervisor config and the target run.sh before enabling it in Supervisor.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Prerequisites

- Bash shell on the machine running the script.
- The target app directory MUST contain a `run.sh` executable — the script hardcodes `command=<dir>/run.sh` into the generated config without checking it exists. If there's no `run.sh`, the generated config will reference a missing file and Supervisor will fail to start the program.

## Full input reference
Confidence
22% confidence
Finding
without checking

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
If not in `$PATH`, add it (bash: `~/.bashrc`, zsh: `~/.zshrc`):

```shell
echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
```
Confidence
75% confidence
Finding
echo 'export PATH="$HOME/bin:$PATH"' >> ~/.bashrc

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.