ClawHub
Back to skill

Security audit

autoskill

Security checks across malware telemetry and agentic risk

Overview

autoskill is a disclosed meta-skill router that can invoke other skills only after a user confirmation step, with no evidence of hidden exfiltration, destructive behavior, or automatic high-risk execution.

Install only if you want a persistent /autoskill command that can coordinate other skills. Review each execution plan carefully, decline any downstream skill you do not trust, and be especially cautious with skills marked high-risk because their effects come from the invoked skill, not autoskill itself.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill advertises itself as a recommender that never invokes other skills without explicit approval, but its implementation is an execution orchestrator that can queue and run other skills. In a meta-skill, this mismatch is dangerous because users may grant it trust based on the safer description while it can trigger downstream skills with broader side effects, increasing the chance of unintended actions or consent bypass through confusing UX.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The safety notice claims the skill does not perform modifications, deployments, or external communications itself, yet the skill is designed to invoke other skills that may do exactly those things. That framing can mislead users during trust decisions and downplay the real operational risk of using a meta-router that chains into high-impact skills.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The installer writes a slash-command whose description and body say it will 'apply all relevant skills' and instruct the agent to read and follow the skill file directly. This conflicts with the stated recommendation-only behavior in the skill metadata and can mislead users into granting broader autonomous behavior than intended, increasing the chance of unintended or unsafe skill execution.

Intent-Code Divergence

Medium
Confidence
99% confidence
Finding
The file-level documentation says no skill is ever invoked without explicit approval, but the generated command directs the agent to 'Read and follow' the skill and says it will 'apply all relevant skills.' This end-to-end inconsistency is a real security issue because the installed artifact, not the prose description, governs behavior at runtime and may cause users or the agent to bypass expected consent boundaries.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.