ClawHub
Back to skill

Security audit

Java Free

Security checks across malware telemetry and agentic risk

Overview

This Java helper is mostly a straightforward code review/generation skill, but it requests broad command execution without a clearly scoped need.

Install only if you are comfortable with the agent having command execution available while using this skill. Prefer a version that removes exec or documents a small, user-confirmed command set such as compile/test commands for specific Java files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill is documented as a Java code review/generation assistant, but it requests `exec` capability despite no clear, necessary workflow step requiring shell or program execution. Unnecessary execution privileges expand the attack surface: if a user supplies a file path, code snippet, or prompt-crafted instruction, the skill could be repurposed to run arbitrary commands or invoke local tooling in ways unrelated to static review.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.