ClawHub
Back to skill

Security audit

RLM Controller

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed long-context workflow tool that writes bounded workspace artifacts and spawns limited subcalls, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable with a skill that can run bundled helper scripts, write analysis artifacts, and spawn sub-agent sessions. Keep redaction enabled for sensitive repositories or logs, review generated prompts/logs before sharing them, and use cleanup carefully because CLEAN_RETENTION=0 removes retained RLM scratch artifacts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises use of powerful capabilities (`read`, `write`, `exec`, `sessions_spawn`) but does not declare permissions in the manifest. That creates a security transparency and governance gap: operators, scanners, or policy engines may not correctly understand the skill's effective privileges, increasing the chance of unintended autonomous file or shell actions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation presents a destructive cleanup command that can delete all files without an explicit warning, confirmation step, or scope clarification. In an operational controller skill that manages run artifacts and scratch state, users may copy-paste this command and unintentionally erase important data in the workspace or other targeted directories.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The tool writes slices of the input context and goal to disk as subcall prompt files, and users can disable secret redaction with `--no-redact` without any warning or confirmation. In a long-context controller designed for huge docs, logs, and repository-scale analysis, those inputs are especially likely to contain credentials, tokens, internal URLs, or sensitive source code, so disabling redaction can cause unredacted secrets to be persisted in plaintext artifacts.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.