ClawHub
Back to skill

Security audit

taskfuel

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for paid API use, but it gives the agent broad activation and automatic software-install authority tied to spending prepaid funds.

Review this before installing. Only use it when you intentionally want taskfuel.ai paid API calls, confirm any CLI installation yourself, and require the agent to quote and get approval before spending funds or connecting the account.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to install software by piping a remote script directly into `sh`, which creates a classic supply-chain and arbitrary code execution risk. This is broader than the stated skill purpose because it authorizes execution of unreviewed code from the network on the host machine, and the danger is amplified by the skill's ability to spend user funds and access local account configuration.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The description triggers on broad conditions like any task that 'needs a paid capability' the agent lacks, which can cause the skill to activate for many unrelated requests and nudge the agent into discovering services, connecting accounts, installing software, or spending prepaid balance unnecessarily. In this context, over-broad activation is more dangerous because the skill can lead to external network actions and paid API calls, not just passive assistance.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.