ClawHub
Back to skill

Security audit

Adguard

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a legitimate AdGuard Home controller, but it uses high-impact admin credentials and live DNS-policy changes with weak transport, default-target, and confirmation safeguards.

Review before installing. Set `ADGUARD_URL` explicitly to your own AdGuard Home host, prefer HTTPS or a trusted local tunnel, avoid storing `ADGUARD_PASSWORD` in shell startup files, and require explicit user approval before running `allow`, `block`, `toggle`, or `cache-clear` because those actions can immediately change network-wide DNS protections.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README explicitly documents commands that can disable DNS protection and modify allow/block rules, but it does not warn users about the security and availability consequences of those actions. In a skill whose purpose is to administer network filtering, this omission can lead to accidental weakening of protections, broader exposure to malicious domains, or service disruption if users run commands without understanding their effect.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly recommends storing an admin password in environment variables and even adding it to shell startup files for persistence, but it does not warn that this can expose credentials through shell history, process environments, backups, dotfile syncing, or local file disclosure. Because these are administrator credentials for DNS filtering infrastructure, compromise could let an attacker disable protection, alter blocklists/allowlists, or inspect and manipulate filtering behavior.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation sets the API base URL to plain HTTP and shows login/authenticated requests without any warning that credentials, session cookies, and potentially sensitive DNS query data would be sent unencrypted if used over an untrusted network. In a skill specifically meant to manage DNS filtering and view query logs, this increases the chance of credential theft, session hijacking, and privacy leakage through copy-pasted insecure examples.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The examples demonstrate allowlisting, blocklisting, and disabling protection without warning that these actions can take effect immediately and materially change network security posture. In this skill context, an agent or user may execute these examples directly, which could unintentionally unblock malicious domains, block legitimate services, or disable DNS protection for all clients relying on AdGuard Home.

External Transmission

Medium
Category
Data Exfiltration
Content
# Get and cache session cookie
get_session() {
    local response
    response=$(curl -s -w "\n%{http_code}" -X POST "${API_BASE}/login" \
        -H "Content-Type: application/json" \
        -d "{\"name\":\"${ADGUARD_USERNAME}\",\"password\":\"${ADGUARD_PASSWORD}\"}" \
        -c "$COOKIE_FILE" 2>/dev/null)
Confidence
97% confidence
Finding
curl -s -w "\n%{http_code}" -X POST "${API_BASE}/login" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
local response
    
    if [ "$method" = "GET" ]; then
        response=$(curl -s -w "\n%{http_code}" -X GET "${API_BASE}${endpoint}" \
            -H "Content-Type: application/json" \
            -b "$COOKIE_FILE" 2>/dev/null)
    else
Confidence
96% confidence
Finding
curl -s -w "\n%{http_code}" -X GET "${API_BASE}${endpoint}" \ -H "Content-Type: application/json" \ -b "$COOKIE_FILE" 2>/dev/null) else response=$(curl -s -w "\n%{h

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.