ClawHub
Back to skill

Security audit

agent-project-structure

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward project folder-organization helper, with the main caution that its create script can add or overwrite small template files in a chosen project path.

Install this if you want a default directory convention for projects. Use the create script only on a new or reviewed target path, and be cautious running it inside an existing project because it may replace its own small template files after you confirm.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill instructs the agent to create or adjust directory structures and explicitly references scripts that can write to the filesystem, but it does not declare any permissions. That mismatch can cause unsafe implicit file-write behavior, reduce auditability, and make it easier for the skill to modify directories without clear user awareness or policy enforcement.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are extremely broad, covering common requests like creating a project or asking about project structure. This can cause the skill to activate unintentionally in unrelated contexts, leading the agent to impose this filesystem layout or perform directory-modifying actions when the user did not explicitly request them.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description says it can create or adjust project structure but does not warn users that this may modify directories and files on disk. Missing disclosure increases the risk of surprise filesystem changes, especially when combined with broad triggers and automation-oriented instructions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.