ClawHub
Back to skill

Security audit

flaw0

Security checks across malware telemetry and agentic risk

Overview

MoltGuard has a coherent security purpose, but it asks users or agents to install a persistent external guard plugin that stores credentials, changes configuration, and exposes API-key material without enough user-controlled scoping.

Install only if you trust OpenGuardrails/MoltGuard as a security provider and are comfortable with a persistent plugin handling security telemetry and local credentials. Require explicit user approval before install, update, enterprise enrollment, or uninstall; do not share /og_status or /og_claim output without redacting keys; verify any enterprise Core URL before enrolling; and understand what data Core receives before using it in sensitive workspaces.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to run enrollment, update, restart, and uninstall commands that change local configuration, persist credentials under user directories, switch service endpoints, or remove files, but it does not clearly warn about those side effects before execution. In an agent setting, undocumented state-changing commands increase the risk of unintended credential exposure, configuration drift, or destructive cleanup being triggered without informed user consent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The `/og_status` command is described as showing the API key, quota, plan, and protection mode, but the skill does not warn that invoking it may reveal sensitive credentials on screen or in logs. In agent workflows, this can cause accidental secret disclosure to the user, chat transcript, screenshots, terminal history, or other integrated tools.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.