ClawHub
Back to skill

Security audit

Gist Share

Security checks across malware telemetry and agentic risk

Overview

This gist-sharing skill appears purpose-aligned, but it gives users public publishing and long-lived GitHub token guidance without enough safeguards for secrets or private data.

Install only if you are comfortable reviewing every gist before publication. Do not upload secrets, tokens, private logs, customer data, internal prompts, or proprietary material. Prefer GitHub CLI or a credential manager over putting GITHUB_TOKEN in shell startup files, use the minimum gist-only scope, and rotate or revoke the token when no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README explicitly instructs users to create public gists and emphasizes that they are readable by anyone, but it does not include a clear warning not to upload secrets, tokens, credentials, internal logs, or other sensitive context. In an agent workflow, 'rich context sharing' can easily include private data, so this omission creates a realistic risk of accidental public data disclosure.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill repeatedly promotes publishing content to public GitHub Gists and emphasizes that they are readable by anyone, but it does not provide meaningful guardrails about not posting secrets, internal logs, credentials, personal data, or other sensitive operational context. In an agent setting, users may paste rich context, reports, or logs that frequently contain confidential information, making accidental public disclosure a realistic risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The instructions recommend persisting `GITHUB_TOKEN` in shell startup files such as `~/.bashrc` or `~/.zshrc`, which increases credential exposure through local compromise, accidental dotfile sharing, backups, screen sharing, and inherited shell environments. The skill does not warn about safer alternatives or the risks of long-lived plaintext credential storage.

Session Persistence

Medium
Category
Rogue Agent
Content
You need a GitHub Personal Access Token (PAT) with the `gist` scope.

### Step 1: Create a PAT

1. Go to [github.com/settings/tokens](https://github.com/settings/tokens)
2. Click **"Generate new token (classic)"**
Confidence
79% confidence
Finding
The skill instructs users to create a classic PAT with `gist` scope for ongoing use, introducing a reusable credential that enables persistent authenticated access beyond a single session. In context, this is not inherently malicious, but it does expand the attack surface if the token is later exposed, especially combined with the later advice to persist it in shell startup files.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.