ClawHub

Autoclaw

Security checks across malware telemetry and agentic risk

Overview

AutoClaw is a local backup and health-check skill with some operational caveats, but I found no hidden network access, credential use, or purpose-mismatched behavior.

Before installing or running, edit the hardcoded workspace path and confirm the listed files are safe to back up. Expect local backups and logs to be created, and older backup folders to be pruned after the retention limit. Do not add it to cron or Task Scheduler until you are comfortable with those local file changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README advertises automated backup cleanup and optional auto-restart, but it does not clearly warn users that these features can modify system state, delete older backups, or restart processes. In an agent skill context, undocumented system-changing behavior increases the risk of unintended data loss, service disruption, or unsafe deployment by users who assume the tool is observational only.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill advertises automated backups of AI agent workspaces without disclosing that it may copy, write, or retain user workspace data. In an agent environment, backups can include sensitive prompts, credentials, documents, or logs, so the omission prevents informed consent and can lead to unexpected data persistence or disclosure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal