ClawHub
Back to skill

Security audit

Mb Init

Security checks across malware telemetry and agentic risk

Overview

This skill creates a project memory-bank folder and optional git commit, and its file-changing behavior is disclosed and aligned with that purpose.

Before using it, confirm the project root is the intended repository and review the generated memory-bank files before running the git commit step. Avoid running it inside an existing memory-bank directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to change directories and create files/directories in the project workspace, which are real side effects. Even though this is the stated purpose of the skill, the absence of an explicit warning/confirmation step increases the risk of unintended modification of the wrong repository or path, especially because the root path is supplied as a variable and the commands are immediately actionable.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill includes a git commit command that alters repository history, but it does not require explicit user consent immediately before committing. In an agent setting, this can create unintended commits, pollute history, or capture sensitive/generated content if prior steps produced incorrect files or targeted the wrong repository.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.