ClawHub
Back to skill

Security audit

ClawHeart Security

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent ClawHeart security helper, but it gives an agent broad local security and credential-adjacent authority without enough guardrails.

Install only if you intentionally want an agent to run ClawHeart against your local AI tooling. Treat provider, API-key, agent, and MCP output as sensitive; review the external installer before running it; and only allow provider add/import/overwrite or init --reset when you explicitly asked for those changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The documented command set includes provider management operations such as `providers {list,add,import,overwrite <id>}`, which expands the skill from passive audit/inventory into potentially state-changing credential administration. In a security-focused skill, exposing these capabilities without strong scope limits or confirmation requirements can lead an agent to touch sensitive provider credentials or alter configuration beyond what the user expected.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The description says the skill should run when the user asks '扫一下 AI 安全' or similar intent, which is an overly broad invocation rule for a skill that can enumerate agents, providers, and credentials. Vague matching increases the chance of unintended execution and unexpected access to local security tooling and sensitive inventory data.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger-to-command mapping covers many broad natural-language intents and directly translates them into local CLI actions, including scans of skills, agents, MCP servers, and providers. Without tighter constraints, an agent may over-trigger these commands and disclose local system, configuration, or credential inventory information the user did not clearly request.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill advertises provider/API key configuration listing without warning that this may reveal sensitive credential inventory or provider metadata from the local machine. Users may interpret this as a harmless diagnostic request, while the command could surface sensitive operational details in conversation output.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.