ClawHub
Back to skill

Security audit

Flowforge Builder Free

Security checks across malware telemetry and agentic risk

Overview

This is a workflow-automation skill whose file, network, command, watch, and cron examples are disclosed and aligned with its stated purpose, though users should scope workflows carefully.

Install only if you intend to let the agent help define or run automation workflows. Review each workflow before execution, keep watched directories narrow, avoid sending sensitive file contents to external APIs, and treat shell commands and cron entries as privileged actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly exposes high-impact capabilities—file writes, file moves, shell command execution, and outbound network requests—without any safety warnings, confirmation requirements, path restrictions, or trust-boundary guidance. In an agent setting, this can lead users to run workflows that modify local files, exfiltrate data, or execute arbitrary commands without understanding the risk.

External Transmission

Medium
Category
Data Exfiltration
Content
{ "action": "read", "file": "${trigger.file}", "output": "fileContent" },

    // 第二步：用fileContent作为输入
    { "action": "fetch", "url": "https://api.example.com/process", "method": "POST", "body": "${fileContent}", "output": "result" },

    // 第三步：用result作为输入
    { "action": "save", "path": "./output/result.json", "input": "${result}" }
Confidence
89% confidence
Finding
https://api.example.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.