ClawHub
Back to skill

Security audit

Forge AI Skill

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Forge AI API helper, but it needs Review because it persists authentication tokens locally and can send user-selected files and raw JSON payloads to a remote service.

Install only if you trust the Forge AI endpoint and are comfortable with the agent creating or updating remote Forge content. Treat .forgeai/session.json as sensitive, avoid running it in synced/shared directories, use logout when finished, and only upload files you explicitly intend to send to Forge.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation describes capabilities that include reading local JSON files, writing session and cache data under `.forgeai/`, and making authenticated network requests, yet no permissions are declared. That creates a trust and review gap: an agent or user may invoke a skill with broader effective access than its metadata communicates, increasing the chance of unauthorized file access, token persistence, or unintended data exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The declared description understates behavior by framing the skill as a Forge integration for articles, evaluations, tags, and authentication, while the documentation also reveals file upload, local persistence of auth/session artifacts, and publishing-related behavior. This mismatch is dangerous because users and security controls may grant trust based on the narrower description, even though the skill can move files off-host and retain sensitive credentials locally.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The session token is stored in plaintext on disk under the current working directory without permission hardening or user disclosure. If another local user, process, or accidental file sync/back-up accesses that file, the bearer token could be reused to impersonate the user against the Forge API.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This command uploads arbitrary file contents to a remote API after base64-encoding them, with no explicit confirmation, privacy notice, or content restrictions. In an agent-skill context, that increases the risk of unintended exfiltration of sensitive local files if the capability is invoked on user-controlled paths.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.