Agent Skills Main

• Outcome: Review
• Latest audit: Jul 19, 2026 · 6:11 AM UTC
• Version: 1.0.0

Overview

The main transcript skill is locally scoped and safety-aware, but the artifact also bundles unrelated high-authority skills and install guidance that do not fit the published skill purpose.

Review this before installing as a ClawHub skill package. The root transcript workflow is designed to stay local and redact sensitive logs, but the artifact carries extra skills with cloud/SSH, clipboard, and raw-session viewing behavior. Install only the intended agent-transcript skill from a clean package or source path, and do not bulk-enable the nested repo unless you also want those broader workflows.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 73% confidence
• Finding: The documented skill purpose is narrow, but the detected behavior set suggests materially broader capabilities including HTML generation/opening, transcript normalization across multiple agent formats, and other review/installation functions not disclosed in the description. That mismatch is dangerous because operators may invoke the skill expecting a constrained local redaction helper while hidden or underdocumented functionality could process additional sensitive data, launch local viewers, or trigger broader repository actions than anticipated.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This skill is materially mis-scoped relative to the declared agent purpose: instead of GitHub PR/issue transcript redaction, preview, and insertion, it provides detailed instructions for remote code execution, cloud-host orchestration, SSH access, desktop control, and untrusted-code testing workflows. That mismatch is dangerous because a caller expecting a narrow transcript-handling skill could be induced to perform high-risk remote operations, expanding capabilities far beyond the intended trust boundary.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill can trigger on broad natural-language phrases like "write a handoff" or "delegate this," which may appear in ordinary conversation rather than as an explicit tool invocation. That creates a prompt-routing vulnerability where the agent may unexpectedly enter handoff mode, causing unintended clipboard actions, context packaging, or leakage of discussion details into a generated prompt.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly states that the generated single-file HTML keeps tool input/output text in the DOM and can be shared, but it does not present a clear warning that this may include sensitive prompts, secrets, file contents, tokens, or other transcript data. In a workflow centered on exporting and sharing transcripts, this omission materially increases the risk of accidental disclosure because users may treat the output as a safe preview rather than a full-fidelity sensitive artifact.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

}

export function deleteUpload(name) {
  return execSync(`rm -rf uploads/${name}`);
}

export function publicUser(user) {

• Confidence: 99% confidence
• Finding: rm -rf uploads/

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: agent-skills-main/skills/agent-transcript/scripts/agent-transcript.test.mjs:19

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: agent-skills-main/skills/autoreview/scripts/test-review-harness.py:57

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: agent-skills-main/skills/session-viewer/scripts/session-viewer.ts:88

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: agent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:964

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: agent-skills-main/skills/autoreview/scripts/autoreview_test.py:332

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: agent-skills-main/skills/autoreview/tests/fixtures/typescript-sensitive-literals.ts:1

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: agent-skills-main/skills/autoreview/tests/test_autoreview_hardening.py:3265