ClawHub
Back to skill

Security audit

Code Analyze

Security checks across malware telemetry and agentic risk

Overview

This code-analysis skill is mostly purpose-aligned, but it makes unclear privacy promises while also allowing external LLM APIs, webhooks, broad code scanning, and automatic local archives.

Install only if you are comfortable reviewing and controlling where analysis data goes. Keep external LLM endpoints and webhook/email notifications disabled for confidential repositories unless approved, and periodically clean or protect .code-analyze reports and history because they may contain sensitive findings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The skill makes conflicting privacy and connectivity claims: it presents core operation as fully offline/local while also documenting optional external LLM API usage and network troubleshooting steps. This can mislead users handling sensitive source code into assuming no network exposure exists when the workflow may in fact transmit content externally under some configurations.

Intent-Code Divergence

High
Confidence
96% confidence
Finding
The documentation states that data does not leave the machine, yet elsewhere allows external API submission and webhook notifications. For enterprise code analysis, this inconsistency is dangerous because users may process proprietary or regulated code under a false assumption of local-only handling, causing unintended data disclosure.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill directs creation of report, framework, and history directories and enables automatic archival without clearly warning that sensitive analysis inputs and findings may be persisted locally. In a code-analysis context, this can leave secrets, vulnerability details, or proprietary code-derived metadata on disk longer than users expect.

Missing User Warnings

High
Confidence
95% confidence
Finding
The optional external LLM API integration is documented without a clear privacy warning that analyzed content may be transmitted off-machine to a third-party service. Because this skill is intended for enterprise code and security review, such transmission could expose confidential source code, vulnerabilities, or credentials to external providers.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.