ClawHub
Back to skill

Security audit

Content Refiner

Security checks across malware telemetry and agentic risk

Overview

This content rewriting skill is not clearly malicious, but it asks for broad command access and optional external LLM processing without tight limits for a text-focused tool.

Review before installing. Use local mode for sensitive drafts, proprietary copy, or regulated content. If you enable LLM mode, assume the submitted text may be processed by the configured model provider. Only install this skill in an agent profile where command execution is limited or where you are comfortable with the agent running troubleshooting commands such as ping.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill is a content rewriting tool, but it instructs the agent to run network-diagnostic commands like ping during error handling. That expands behavior from text processing into host command execution, which can be abused to trigger unnecessary system actions, leak environment/network details, or normalize unsafe troubleshooting steps unrelated to the user task.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The manifest presents the skill as a rewriting tool, but the documented runtime requirements and behavior broaden it to exec-based file and command operations. This scope mismatch is risky because users may authorize a harmless-looking text tool while the agent gains permission to execute shell actions beyond rewriting.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill advertises LLM-mode rewriting but does not clearly warn that user-provided content may be transmitted to an external model provider. For a rewriting tool, user input may include drafts, proprietary marketing copy, or sensitive business text, so silent external sharing creates a real privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The markdown encourages file read/write and command execution via exec without an explicit integrity warning about effects on the host environment. Even if the current examples are simple, normalizing unrestricted exec in a content tool increases the chance of unsafe future use, unintended file access, or command injection through agent behavior.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.