ClawHub
Back to skill

Security audit

Agent Scorecard

Security checks across malware telemetry and agentic risk

Overview

This is a local AI-output scoring tool whose file access and saved history are aligned with its stated evaluation and reporting purpose.

Install only if you are comfortable evaluating and storing agent outputs locally. Avoid using manual preview or saved history/reports with secrets, private prompts, personal data, or proprietary content unless your terminal and output directory are trusted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation describes local file read and write behavior such as loading config files, reading agent responses, appending to JSONL history, and generating reports, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or hosting platforms may treat the skill as lower risk than it is, while it can still access and modify local files during normal use.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
In manual mode, the tool prints a preview of the input text directly to the console without warning or redaction. If the evaluated content contains secrets, personal data, proprietary prompts, or tokens, they may be exposed in terminal history, screen recordings, logs, or to nearby observers; the skill context makes this more plausible because agent outputs often contain sensitive material under review.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.