ClawHub
Back to skill

Security audit

Pyx Scanner Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed scanner wrapper that sends a skill identifier to an external scan API and formats the result, with no hidden persistence or destructive behavior found.

Before installing, understand that using this skill sends the requested skill identifier to scanner.pyxmate.com and may use curl or simple network diagnostics if the API call fails. Avoid submitting internal repository or private skill names unless that disclosure is acceptable, and require confirmation before any ping, firewall, or proxy checks are run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill is presented as a scanner/reporting tool, but the error-handling section instructs the agent to perform active network diagnostics and troubleshoot firewall/proxy settings. That expands the operational scope from passive analysis into host/network interaction, creating a path for unnecessary command execution and environment probing beyond user expectations.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Executing ping and inspecting firewall/proxy connectivity is not required to assess the security of a third-party skill and introduces unrelated system/network probing. In an agent environment with `exec`, such instructions can lead to overbroad command execution, leaking network topology or changing operator trust boundaries under the guise of harmless error handling.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation omits a clear warning that the requested skill identifier will be sent to an external service at `scanner.pyxmate.com`. This creates a transparency and privacy problem because users may disclose internal or unreleased repository identifiers to a third party without informed consent.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.