ClawHub
Back to skill

Security audit

Claude Code Delegate Free

Security checks across malware telemetry and agentic risk

Overview

This is a basic coding-assistant skill whose file and command access matches its stated purpose, though users should supervise any command execution.

Install this as a general coding helper only if you are comfortable with it reading project files and running commands when needed. Keep tasks scoped to the current workspace and review any command that could modify files, access the network, or affect your system.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly advertises instruction execution and core processing, and the metadata enables the `exec` tool, but the documentation provides no prominent warning, consent boundary, or restriction on system-impacting actions. In an agent environment, this can normalize command execution from natural-language input and increase the chance of unsafe local commands being run on the host.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The examples and error-handling guidance encourage operating on local files and running commands such as `ping` to troubleshoot failures, yet they do not disclose safety implications or impose boundaries. This is dangerous because a general-purpose coding skill with `read` and `exec` can be induced to access sensitive files or execute host commands during routine workflows without clear user awareness or approval.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.