Security audit

Skill Sync

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it can automatically publish and push local skill repositories with weak review controls and unsafe shell command construction.

Install only if you deliberately want an automated publisher for your own skill repositories. Before running it, disable unattended cron, add a real dry-run or review step, require confirmation before publish/push, audit synced repositories for secrets, keep the allowlist narrow, and fix command construction so metadata cannot execute shell commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The security section claims the skill only affects the skills directory, but the documented behavior writes status and log data under a separate memory path outside that directory. This can mislead users about the write scope of the skill, causing them to grant trust or automation permissions without understanding that additional files will be created or modified.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises automatic publishing, commits, and pushes without an explicit warning that these are state-changing local and remote operations. In an agent context, this increases the risk of unintended publication of sensitive content or unintended repository mutations, especially if users trigger the skill expecting a read-only sync check.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The recommended cron job enables unattended hourly execution that can automatically publish to ClawHub and push to GitHub, but the documentation does not prominently warn users about continuous autonomous remote actions. In a long-running automation context, a bad skill change, secret inclusion, or malformed update could be repeatedly published without human review.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The configuration example disables publication confirmation with `requireConfirmation: false` while also enabling automatic commit and push. This lowers safeguards around irreversible or externally visible actions, making accidental disclosure, unwanted publication, or propagation of unsafe changes more likely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script automatically publishes to ClawHub and pushes to GitHub for every detected skill without any interactive confirmation, dry-run safeguard, or explicit opt-in flag. In a tool that scans directories and makes remote state changes, this creates a real risk of accidental publication or unintended code push if the detection logic, local metadata, or repository contents are wrong.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/sync.cjs:290