ClawHub
Back to skill

Security audit

社区垃圾过滤(免费版)

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent client-side community spam-filtering guide, with expected command and API-key use but no evidence of hidden, destructive, or unrelated behavior.

Before installing, treat this as a local command-running skill that may interact with a platform API key. Use a read-only or least-privileged key, do not paste or log credential contents, and review any filter.js or downstream tool before running the documented commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill advertises read/exec/write tooling and a workflow involving credentials and command execution, but it does not provide a clear warning about filesystem changes, command execution risk, or possible exposure of sensitive data. In an agent context, that omission can cause users to authorize a skill without understanding that it may access credentials or modify local state.

Credential Access

High
Category
Privilege Escalation
Content
不适用于:服务端垃圾防御、账户封禁、内容举报、ML垃圾检测.
## 使用流程

1. 确认凭证文件 `./.config/platform/credentials.json` 存在且API key有效
2. 确认 Node.js 运行时已安装
3. 用 `node filter.js scan [submolt]` 扫描目标子板块,查看垃圾率
4. 用 `node filter.js feed [submolt]` 获取过滤后JSON,管道到下游工具
Confidence
93% confidence
Finding
credentials.json

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.