ClawHub
Back to skill

Security audit

Clawpheus

Security checks across malware telemetry and agentic risk

Overview

Clawpheus is a local, user-invoked dream-journal skill whose memory access and saved outputs match its stated purpose, with optional scheduling users should review before enabling.

Install only if you are comfortable with the agent reading recent memory or journal content and saving generated dream material locally, and possibly into Engram. Leave cron scheduling disabled unless you explicitly want recurring background dreams, and use --save false or remove memory/dreams files if you do not want persistent records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents cron-based automatic execution that reads prior memories/journal content and writes dream artifacts to persistent storage, but it does not present a prominent warning or explicit consent boundary at the scheduling point. This creates a real privacy and persistence risk because sensitive memory content may be processed and retained repeatedly without the operator clearly understanding the recurring data access and storage behavior.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.