Security audit

Clawddocs

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a documentation helper, but it asks for command execution authority and gives vague run instructions that are not clearly needed for that purpose.

Install only if you are comfortable giving this documentation helper command execution authority. Prefer a version that removes exec or clearly states the exact commands it may run, requires user confirmation, and documents why execution is needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a documentation/navigation assistant, but its documented outputs and examples expand into workflow execution and command-like behavior beyond simple doc lookup. This mismatch can mislead users and downstream agents into granting broader trust or permissions than the skill’s stated purpose warrants, increasing the chance of unsafe execution paths.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The description claims that risky code was removed and safety was improved, yet the skill still advertises `exec` tooling and includes command-running guidance. Security-reassuring claims that conflict with actual capability are dangerous because they reduce operator suspicion and can cause unsafe trust decisions.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The inline safety language directly conflicts with the presence of executable capability in the same skill. This is dangerous because misleading assurances can be used, intentionally or not, to bypass scrutiny and normalize the use of a higher-risk skill in environments where only documentation access was expected.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The skill exposes arbitrary execution capability via the `exec` tool even though its stated role is a documentation expert with decision-tree navigation. In this context, execution is not inherently necessary, so an attacker could abuse the trust associated with a doc assistant to run local commands, access files, or chain further actions on the host.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The example instructs the agent to run a script-like command reference without any clear warning, approval step, or explanation of system impact. Even if the exact script is unspecified, this normalizes execution from markdown instructions and can lead agents or users to trigger local code with unclear provenance.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.