ClawHub
Back to skill

Security audit

Hyperv Create Vm

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-aligned Hyper-V VM automation, but it needs review because it combines administrator-level infrastructure changes with under-guarded deletion and password handling.

Install only if you are comfortable manually supervising administrator-level Hyper-V changes. Confirm the exact host, VM name, and VHDX path before running commands; do not use unreviewed replacement PowerShell scripts for the missing files; avoid returning VM passwords in chat logs; use a throwaway credential or SSH keys; and add an explicit confirmation step before any destroy operation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrases are broad enough that the skill may be selected for generic VM-creation requests without sufficient confirmation that the user wants a Hyper-V-based Ubuntu VM on a privileged Windows host. Because this skill performs infrastructure changes, downloads images, and requires elevated PowerShell on a Hyper-V host, accidental invocation could lead to unintended resource creation and unsafe execution in the wrong environment.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill includes forceful teardown commands that stop and permanently delete a VM and its virtual disk, but it does not place an explicit irreversible-deletion warning immediately around those commands. In an automation context, users or downstream agents may run the snippet as provided, causing unrecoverable destruction of infrastructure and data.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.