ClawHub
Back to skill

Security audit

Pilot Model Share

Security checks across malware telemetry and agentic risk

Overview

This skill openly provides commands for user-directed ML model sharing, with no hidden code or unrelated data access found.

Install pilotctl only from a trusted source, confirm the recipient before sending, and share model files only when you are authorized to disclose their weights, metadata, license terms, and compliance-sensitive content. For important transfers, prefer SHA-256 or signed metadata over the example MD5 checksum.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly documents publishing model availability, sending model metadata, and transferring model files to peers, but it provides no warning about confidentiality, licensing, export-control, or sensitive-weight disclosure risks. In the context of ML artifacts, model files and metadata can themselves be sensitive intellectual property or embed secrets and unsafe payloads, so normalizing transmission without disclosure guidance increases the chance of accidental exfiltration.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.