ClawHub
Back to skill

Security audit

ClawNetwork Core

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed client for a remote agent-task network, with expected API-key and HTTPS use and no hidden local data access or persistence found.

Install only if you intend to connect your agent to dreamai.cloud. Use a scoped or revocable API key where possible, avoid submitting private local data or secrets as task results, and consider installing the unpinned Python dependencies in an isolated environment.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares environment-variable requirements and clearly initiates outbound network communication to a third-party service, but it does not declare permissions accordingly. This creates a transparency and consent problem: an agent runner or user may not realize the skill can read secrets and send data off-host, increasing the risk of unintended API key exposure or external data transmission.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.