ClawHub
Back to skill

Security audit

debugging-and-error-

Security checks across malware telemetry and agentic risk

Overview

This debugging skill is not malicious, but it asks for command authority while describing much broader automation, API, credential, and batch-processing use than its stated purpose supports.

Review this skill carefully before installing. It appears to be broad generated automation guidance rather than a tightly scoped debugging helper; only use it where you are comfortable with an agent reading files, running commands, and potentially interacting with APIs under your explicit direction.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The skill is presented as focused root-cause debugging, but the body expands into generic automation, API usage, file handling, and command execution. This scope drift can cause an agent to invoke the skill in situations far beyond debugging, increasing the chance of unintended privileged actions and misuse under a misleading description.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
Documenting command execution in a skill whose stated purpose is advisory debugging materially increases risk because agents may run shell commands under the guise of troubleshooting. In contexts with `exec` tooling, this can lead to filesystem changes, data exposure, or execution of unsafe commands without users understanding the expanded authority.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill introduces API connections, credentials, and multi-interface aggregation beyond a debugging-only remit, which broadens access to external systems and secrets. That mismatch makes it easier for a generic task to trigger networked or credentialed actions under an underspecified trust model, raising the risk of data leakage and over-collection.

Vague Triggers

High
Confidence
95% confidence
Finding
The activation criteria are extremely broad, covering general efficiency improvement, automation, batch processing, and workflow optimization. Overbroad routing language can cause the skill to be selected for many unrelated tasks, effectively turning a nominal debugging skill into a catch-all automation capability with access to powerful tools.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.