ClawHub
Back to skill

Security audit

ProcessGuard — Critical Process Monitor & Auto-Restart

Security checks across malware telemetry and agentic risk

Overview

ProcessGuard is a disclosed local process watchdog with powerful but purpose-aligned restart, alerting, heartbeat, and dashboard features.

Install only if you want a local watchdog that can restart services. Prefer commandAllowlist, avoid allowAnyCommand unless you fully trust the config, run it as a least-privileged service account, keep dashboard access local or protected, and send webhooks only to trusted endpoints.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly advertises shell-command health checks and auto-restart behavior, which implies it can execute local commands and restart services, but the description shown here does not surface the operational and security risks of doing so. In a monitoring tool this behavior is expected, but without prominent warnings about command execution, privilege level, restart loops, and safe configuration, users may deploy it in ways that enable abuse or accidental disruption.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The metadata description promotes webhook/callback alerts, file writes, heartbeat output, and an HTTP dashboard, all of which create file-system and network side effects that may expose status data or internal service information if enabled insecurely. The functionality is legitimate for a process monitor, but the absence of warning language about data exposure, binding scope, authentication, and sensitive paths increases the risk of unsafe deployment.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
src/process-guard.js:203