ClawHub
Back to skill

Security audit

Flexible Database De

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for database setup guidance, but it grants and describes local execution and project modification with loose scoping and missing bundled assets, so it should be reviewed before installation.

Review this skill before installing. Use it only in a project where you intend to let an agent create database files, edit scripts, and run local Python commands. Ask the agent for a plan first, approve each write or command explicitly, and verify any generated scripts because the package does not include the referenced script templates.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill markets itself as having removed risky code and external dependencies, yet it explicitly instructs use of exec-enabled workflows, shell tools, optional package installation, and LLM-based extractors. This mismatch can lower operator vigilance and cause users to authorize file system or command execution under a false assumption of safety.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest presents the skill as guidance, but the body instructs the agent to create directories, copy scripts, modify project files, and run local commands. That scope expansion is dangerous because users or supervising systems may grant it lower scrutiny than an execution-capable automation skill, increasing the chance of unintended file modification or local command misuse.

Vague Triggers

Medium
Confidence
88% confidence
Finding
Broad trigger keywords such as generic database or knowledge terms can cause accidental invocation in unrelated contexts. Because this skill has documented file-writing and command-execution behavior, unintended activation raises the risk of unauthorized modifications or execution in the wrong project context.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs the agent to copy scripts, create a data directory, change paths, and execute commands, but it does not prominently warn that it will modify the user's workspace. In an agent environment, insufficient disclosure is risky because users may not realize the skill can alter files or run code locally.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
## 工具声明（Skill平台 / SkillHub）

allowed-tools:

* Bash
* FileRead
Confidence
93% confidence
Finding
The skill requests broad tool access including Bash, FileRead, FileWrite, and Shell without tightly scoping when or why each is needed. In combination with instructions to create files and run commands, this increases the attack surface and the potential for unintended local execution or workspace modification if the skill is triggered improperly.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.