ClawHub
Back to skill

Security audit

Cloud Architect Design

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly cloud-architecture planning guidance, but it also leaves room for shell execution and real cloud CLI deployments without clear safeguards.

Install only if you want a planning skill that may also guide operational cloud checks. Do not provide production cloud credentials by default; use least-privilege, preferably read-only or sandbox credentials, and require explicit review before any Terraform or cloud CLI command that could create, change, or deploy resources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
86% confidence
Finding
The documentation says the core functionality does not require exec, yet the skill both declares exec and repeatedly instructs command execution such as ping/network tests. This mismatch can mislead users and agents into granting higher privileges than expected, increasing the chance of unintended command execution in environments where the skill was assumed to be documentation-only.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill invites optional use of cloud CLI credentials for real resource queries and deployments without explicit warnings about cost, data exposure, permission scope, or infrastructure changes. In a cloud-architecture context, this omission is more dangerous because users may supply powerful production credentials and assume the skill is low-risk planning-only documentation.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.