ClawHub
Back to skill

Security audit

Can Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple local content-addressing and audit-log guide, with a disclosed but somewhat underspecified local append-only log.

Before using this skill, decide where the local log should live and what labels are safe to store. Treat hashes, timestamps, and human-readable labels as potentially sensitive metadata, especially when logging outputs from private tools, APIs, or agent conversations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill repeatedly instructs the agent to append records to a local append-only log, but it does not clearly disclose where files will be written, how the path is chosen, or the privacy and persistence implications of storing user or tool-derived content locally. In an agent context with `exec` capability, implicit local writes can surprise users, create unauthorized data retention, and expose sensitive content through logs.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.