ClawHub
Back to skill

Security audit

Geoskill: RS Index Calc

Security checks across malware telemetry and agentic risk

Overview

This skill is a small, disclosed GeoTIFF index-calculation helper with no evidence of hidden privileges, persistence, credential access, or unrelated behavior.

Install only if you want a local GeoTIFF spectral-index helper. Expect it to read imagery paths you provide and write result files where you direct it; review the remote repository before using README install commands because the reviewed artifact does not include the referenced calculator script.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
The document opens primarily in Chinese and the initial usage description is Chinese-first, while only a later anchor link offers English. This can be read as a locale/language preference baked into the skill presentation without clear opt-in, which matches the policy concern for forced language or locale behavior.

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
This markdown file contains a substantial Chinese-language section alongside the English content, but it does not explicitly tell users they may choose their preferred language or indicate that the locale is optional. Under the policy rule, natural-language constraints or defaults should not force a specific language without user opt-in.

Scope Creep

Low
Category
Excessive Agency
Content
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Confidence
70% confidence
Finding
NOT LIMITED TO

Hidden Instructions

High
Category
Prompt Injection
Content
# Remote Sensing Index Calculator · 遥感指数计算器

> 输入 GeoTIFF 影像路径 + 指数名，自动计算并输出。
> 支持 **NDVI / NDBI / NDWI / EVI / SAVI / MNDWI / AWEI / NBR / BSI / UI**。
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.