ClawHub

CMCC 3CC CellSetUp

Security checks across malware telemetry and agentic risk

Overview

This skill is only a demo script, but it presents fixed success messages for a high-impact telecom configuration workflow without real checks or safety guardrails.

Treat this as a simulated demo, not a real provisioning tool. Do not rely on its success output for network decisions or production changes unless it is rewritten to use real inputs, scoped targets, explicit approvals, audit logs, verification, and rollback procedures.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill claims it can determine readiness, generate plans, assemble scripts, execute configuration, and evaluate results, but the provided code only prints progress messages and delays. This mismatch can mislead operators into believing real network changes or validations occurred, creating operational and security risk if decisions are made based on false success output.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The comments and status messages describe concrete operational tasks such as connecting to devices, uploading scripts, executing commands, and confirming success, but none of these actions actually occur. In an infrastructure context, deceptive operational messaging can cause unsafe reliance, skipped verification, and mistaken belief that critical network procedures completed successfully.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill presents a workflow for direct network configuration and script execution without any warning about service impact, authorization requirements, rollback needs, or the risks of modifying production telecom equipment. In this context, omission of safety guardrails increases the chance that users treat the workflow as safe to run blindly, potentially causing outages or unauthorized changes.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal