ClawHub
Back to skill

Security audit

python-dev

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Python tooling setup skill with project-scoped commands and no hidden execution or data access.

Install if you want an opinionated Python development setup. Review templates before applying them because they can change project configuration, add development dependencies, install pre-commit hooks, auto-format code, and delete generated caches or virtual environments when cleanup/reset commands are run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes broad activators such as "python project", which can cause the skill to auto-activate in many unrelated contexts. Over-broad invocation increases the chance that users receive prescriptive setup actions or shell commands they did not intend to request, expanding the blast radius of any risky guidance embedded in the skill.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The Justfile includes destructive cleanup commands like `rm -rf dist/ build/ ...` and recursive deletion of `__pycache__` directories, but the skill does not prominently warn users that these commands delete local files. In a development skill that encourages copy-pasting templates, omission of a warning can lead to accidental data loss, especially if users modify paths or run the recipe from an unexpected directory.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The reference includes a destructive reset command (`rm -rf .venv && uv sync`) in troubleshooting guidance without an explicit warning that it deletes the local virtual environment. While limited to a project-local path and common in Python setup docs, users may copy-paste it blindly and lose local environment state or custom packages, especially in atypical directory layouts or if variables/aliases are later substituted into similar commands.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.