ClawHub

PasteClaw

Security checks across malware telemetry and agentic risk

Overview

PasteClaw does what it says, but its default examples weaken HTTPS protections while uploading content and edit tokens to an external paste service.

Review before installing. Use it only for material you intend to share externally, remove `-k` from curl commands so HTTPS certificates are verified, avoid uploading secrets or private configs, and confirm the snippet ID and edit token before any update or delete.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill is explicitly designed to publish content to a third-party paste service, but it does not instruct the agent to obtain user confirmation or warn that pasted content leaves the local environment and may be retained by an external provider. This creates a real risk of accidental disclosure of sensitive prompts, source code, credentials, personal data, or proprietary material.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill documents update and delete operations against remote snippets but does not require confirmation before modifying or deleting remote content. In an agent setting, this can lead to unintended data loss, destructive changes, or tampering with shared artifacts if an edit token is present in context.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The skill encourages sending model and tool identifiers in request headers for traceability without warning that this shares environment-identifying metadata with the external service. While lower severity than content exfiltration, it can still leak operational details useful for profiling, targeting, or privacy-invasive analytics.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal