ClawHub
Back to skill

Security audit

漏洞扫描器(免费版)

Security checks across malware telemetry and agentic risk

Overview

This is a local static security-scanning skill with some vague callback/export wording, but no artifact evidence of hidden execution, persistence, or data exfiltration.

Install only if you are comfortable letting the agent read the project you ask it to scan and run local Python commands. Avoid using callback_url unless you intentionally want scan-completion data sent to a URL, and review scan output carefully because it may include partial secret values or sensitive file paths.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The skill markets itself as a local/static scanner, yet it documents a `callback_url` for asynchronous notification. That creates an unexpected outbound data flow channel that could disclose scan results, file paths, or other sensitive metadata to external systems, especially if users assume all processing remains local.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises create/query/export operations and callback handling without warning about disclosure or file-impacting behavior. In an agent context with `read` and `exec` tools, vague export/create semantics can cause users to expose scan artifacts, overwrite files, or transmit sensitive repository data without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.