ClawHub
Back to skill

Security audit

industry-morning-brief

Security checks across malware telemetry and agentic risk

Overview

This skill is a public-news briefing helper that uses a bundled curl script to fetch search results, with no evidence of hidden data access or destructive behavior.

Install only if you are comfortable with the agent running the bundled shell script and making public web requests for news searches. Review custom query values before running; no API keys or private data are needed for the stated workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes a shell script (`bash scripts/brief.sh`) and requires `curl`, but it does not declare any corresponding permissions or execution constraints. This creates an execution-capability mismatch: an agent may run networked shell commands without an explicit trust/approval boundary, increasing the risk of command misuse, unexpected external access, or unsafe parameter handling in downstream scripts.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.