ClawHub
Back to skill

Security audit

alibabacloud-livedebug

Security checks across malware telemetry and agentic risk

Overview

The skill matches its live-debugging purpose, but it needs Review because it can add probes to running Alibaba Cloud services and collect broad runtime data without enough safety prompts.

Install only for operators who are allowed to instrument the target service and read its SLS logs. Use a RAM sub-account, avoid wildcard targets on production, confirm the exact service and instance IDs before creating probes, keep TTL and capture counts low, avoid auth/payment/user-secret fields, and clean up probes promptly.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly enables dynamic logging, snapshots, JVM inspection, and result querying on live services, but it does not prominently warn that these operations can capture secrets, PII, tokens, stack traces, and other sensitive runtime data from production systems. In this context, omission of privacy and production-safety guidance is dangerous because the documented workflows encourage broad targeting such as `*` instance selection and powerful inspection features, increasing the chance of over-collection and operational impact.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The examples demonstrate capturing arguments, locals, return values, exceptions, object graphs, and stack traces without clear warnings that these fields often contain credentials, personal data, session identifiers, and internal business data. Because the examples are copyable and target live runtime diagnostics, they materially increase the risk of sensitive-data exposure through logs and SLS capture results.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.