ClawHub
Back to skill

Security audit

Omega Notation

Security checks across malware telemetry and agentic risk

Overview

Omega Notation is a small, disclosed compression helper for structured agent messages, with a parsing accuracy caveat but no evident unsafe access or hidden behavior.

Safe to install for compact structured outputs between trusted agents. Do not rely on Omega messages alone for high-impact routing, policy, finance, or audit decisions; keep original data or add validation, and use explicit dictionaries when messages cross trust boundaries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The header comments state that deserialization restores objects with 'full round-trip integrity'. However, the implementation does not faithfully round-trip all serialized data: `parseProps` splits on whitespace and `:` so values containing spaces or extra colons are truncated, quoted `reason` values are mishandled, and `dict` objects are serialized as JSON but deserialized only with `dict=(\S+)`, which cannot recover spaced JSON. This is an active contradiction between the documented intent and the actual behavior.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.