ClawHub
Back to skill

Security audit

Skill Updater

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate skill updater, but it can persistently change installed skills and its safety promises are not fully matched by the implementation.

Install only if you explicitly want this tool to manage local clawhub skill updates. Use it on backed-up skills first, prefer specifying a single skill, review patches manually, and avoid relying on --dry-run or automatic preservation until the updater has stronger confirmation and baseline-snapshot safeguards.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares no permissions even though its documented behavior requires environment access, filesystem reads/writes, and shelling out to external binaries. That mismatch weakens security review and user consent because operators cannot accurately assess what the skill is capable of before running it.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The documented behavior materially exceeds the claimed safe updater role: it can discard saved state, invoke external registry/update operations, write conflict artifacts, and reportedly overwrite the stored originals snapshot in a way that undermines the promise of preserving local modifications. In an updater skill, this is dangerous because users are likely to trust it with existing customized code, so destructive or misleading update semantics can cause silent loss of changes or unintended remote modifications.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger phrases are broad and ambiguous, which increases the chance the skill will activate in contexts the user did not intend, such as generic update or sync requests. Because this skill performs file modifications and external command execution, accidental invocation materially raises the risk of unwanted changes to installed skills.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases "auto update" and especially "git sync" are broad, generic terms that may appear in normal user requests unrelated to this specific skill. In an updater skill, accidental activation is more dangerous because it can initiate repository synchronization or update-related workflows that modify local state or pull remote content when the user did not explicitly intend to use this skill.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.