ClawHub
Back to skill

Security audit

UNIHIKER K10 Box PlatformIO

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent hardware-development helper that installs a pinned K10 box driver into a user-chosen PlatformIO project and does not show hidden data access or unrelated behavior.

Before installing, review that the script will download driver files from the disclosed upstream commit and write them under the PlatformIO project path you provide. Use --force only when you are comfortable replacing the existing DFRobot_K10Box library, and follow the skill's guidance to trigger actuator tests only deliberately with the hardware area clear.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to read local reference files, execute shell commands, and modify project contents via an installer script, but it does not declare any permissions. That mismatch is a real security issue because it hides the skill's operational capabilities from the permission model and can lead to unauthorized file access or command execution if invoked in a broader agent environment.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.