ClawHub
Back to skill

Security audit

Virtual Screening

Security checks across malware telemetry and agentic risk

Overview

The skill matches its virtual-screening purpose, but it gives changing remote documentation authority to drive API code while using a local SciMiner credential and uploaded user files.

Install only if you trust SciMiner and are comfortable storing a SciMiner API key locally and sending screening inputs to sciminer.tech. Prefer using it with non-sensitive structures or libraries unless you have confirmed the service terms, and review remote API docs before allowing generated code to run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
4. Collect any missing required parameters from the user.
5. Upload required file inputs exactly as described by the selected Markdown
   doc and replace local paths with returned `file_id` values.
6. Write or run the invocation code directly from the selected Markdown doc's
   base-information block, parameter table, file-upload instructions, and
   example code. Do not apply a shared invocation template or local registry
   abstraction in this skill.
Confidence
88% confidence
Finding
The skill instructs the agent to read remote Markdown from an external website before every invocation and then write or run invocation code directly from that documentation. This creates a dynamic remote-instruction/code-sourcing channel: if the hosted docs are compromised, tampered with, or contain unsafe example code, the agent may execute attacker-controlled request logic, alter destinations, or mishandle credentials and uploaded files.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.