Security audit

Skill Security Scanner

Security checks across malware telemetry and agentic risk

Overview

This is a real security-scanning skill, but it has unsafe command handling, broad activation guidance, unconfirmed remote archive extraction, and a prefilled trust whitelist that users should review before installing.

Review before installing. Use only explicit local paths or trusted URLs, avoid passing untrusted target strings through the Node wrapper, inspect or clear whitelist.txt first, and treat the scanner's results as advisory rather than comprehensive security approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The script claims to validate its JSON output, but the check only parses a hardcoded '{}' instead of the generated report. This creates a false sense of assurance: malformed or injection-prone JSON could be emitted while the script still reports validation success, which can mislead downstream automation that relies on machine-readable output.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The report says all threat categories and listed rules were checked, but the implementation only covers a subset. This is a security integrity issue because users may trust the report as comprehensive and make installation decisions based on overstated coverage, reducing effective scrutiny of unimplemented threats.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger guidance uses very broad single-keyword activation terms such as 检测、扫描、安全、风险 that are common in normal conversation. This can cause the skill to activate unintentionally and override user intent or route benign conversations into security-scanning behavior, especially in shared or multi-skill environments.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The example phrase 帮我看看这个 skill：clawsec is ambiguous and does not clearly require a security scan action. In context, the document says the agent should interpret this as sufficient to execute scanning behavior, which increases the chance of unintended activation from vague user requests.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger phrases are generic natural-language queries such as 'detect [skill]', 'is [skill] safe?' and 'does [skill] have issues?', which are likely to match ordinary conversation rather than an explicit invocation. In an agent environment, overly broad triggers can cause the skill to activate unintentionally, leading to unsolicited scanning behavior, context hijacking, or interference with other skills and normal user interactions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When given a remote ClawHub URL, the script automatically downloads and unzips remote content without user confirmation or prominent warning. In a security scanner context, this is risky because analyzing an untrusted target should not itself trigger network retrieval and archive extraction silently; it expands attack surface and may expose the host to malicious archives or unexpected content.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.js:8