ClawHub
Back to skill

Security audit

工具编排器

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for encrypted memory management, but it asks the agent to restart runtime behavior without user approval and can launch a detached pairing process that may outlive normal tool controls.

Review this before installing if you are uncomfortable with a skill that manages persistent memory, installs/enables a plugin, performs browser-based credential pairing, may restart its runtime integration automatically, and may use a detached fallback process during pairing. Do not paste recovery phrases into chat; use only the browser pairing flow described by the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to autonomously issue a restart slash command without user approval. Even if intended for recovery, this expands the skill from memory orchestration into agent/runtime control, which can disrupt sessions, mask faults, or normalize self-directed control actions beyond the user's explicit request.

Session Persistence

Medium
Category
Rogue Agent
Content
→ 返回 `{"url":"https://…/pair/p/<id>#pk=…","pin":"123456","expires_at_ms":…}`

   **不要使用 `tr pair --json`。** CLI在子进程中持有配对WebSocket,会被约30秒shell工具超时杀死,WS随后断开,用户提交短语时中继返回502。上述进程内路由完全避免此问题。仅在路由不可达时回退到CLI,且必须分离运行使WS存活: `setsid -f node "$TR_CLI" pair --json < /dev/null`。

2. 原样向用户展示 **url** 和 **pin**(从JSON读取,绝不编造值):"在浏览器中打开 `<url>`,输入PIN `<pin>`,生成或粘贴你的12词恢复短语。完成后回复done。" URL作为纯文本单独一行输出,`#pk=` 片段在反引号/markdown中会损坏。
Confidence
89% confidence
Finding
setsid

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.