ClawHub
Back to skill

Security audit

Project Router

Security checks across malware telemetry and agentic risk

Overview

Project Router is purpose-aligned but should be reviewed because it can run project-defined shell commands and apply file-writing plans without built-in approval or containment checks.

Install only for trusted workspaces. Inspect `.project/targets.json` before running any target, inspect plan JSON before applying it, avoid enabling the MCP server for unfamiliar repositories, and verify the MCP server points to the reviewed project CLI rather than an unrelated local binary.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The Trello sync operation explicitly creates boards/lists, upserts cards, moves cards, and applies labels, which are remote state-changing actions. Without a clear user-facing warning or confirmation step, an agent could modify external systems unexpectedly, causing data leakage, workflow disruption, or unintended task creation in a live Trello workspace.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill documents `project target run <name>` and later notes that `project_target_run` executes commands defined in `.project/targets.json`, meaning it can run shell commands from project-controlled configuration. In a security-sensitive agent context, this is dangerous because opening an untrusted repository or bundle could lead the agent to execute arbitrary commands with the user's privileges.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The CLI executes command strings from .project/targets.json via spawnSync(..., { shell: true }), which allows any project-supplied target to run arbitrary shell code with the user's privileges. In a terminal-first bootstrapper that is expected to operate on untrusted or newly cloned repositories, this creates a strong trust-boundary violation because merely invoking a named target can trigger hidden destructive commands, credential theft, or persistence.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
Applying a saved plan blindly writes each listed path under the project root without any review, diff, or confirmation, so a crafted or tampered plan file can silently overwrite important project files. Although writes are joined to the root, this skill's purpose is to bootstrap and modify workspaces, so silent mutation of repository state is security-relevant and can be used to plant malicious configuration or scripts that execute later.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The server exposes state-changing operations that directly invoke the underlying `project` CLI, including `project_target_run` and `project_plan_apply`, without any confirmation, policy gate, allowlist, or read-only separation. In this skill context, the tool is explicitly designed to bootstrap workspaces, run build/test/deploy targets, and apply plans, so an LLM or connected client could trigger arbitrary project-defined commands or write actions in the current workspace with no additional user approval.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
*
 * MCP server that wraps the `project` CLI.
 *
 * Tools:
 * - project_detect
 * - project_context_read
 * - project_target_list
Confidence
83% confidence
Finding
Tools: *

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/project.js:257

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/server.js:178