ClawHub
Back to skill

Security audit

Rust避坑指南(免费版)

Security checks across malware telemetry and agentic risk

Overview

This is a Rust coding guidance skill with broad agent tool permissions, but the artifact shows no hidden automation, exfiltration, persistence, or destructive behavior.

Installers should understand that this skill can authorize an agent to read files, run commands, and write changes in a workspace. Use it for Rust coding help where those actions are appropriate, and review proposed command runs or file edits before applying them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The manifest declares both `exec` and `write` capabilities, which enable command execution and file modification, but the visible skill documentation presents the skill as a benign Rust guidance tool without clearly warning that it may run commands or alter files. This creates a trust gap: users may invoke the skill expecting advisory output only, while the agent is technically authorized to perform side effects that could impact the local environment or repository.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.