ClawHub

RankClaw

Security checks across malware telemetry and agentic risk

Overview

RankClaw is a disclosed remote security-checking skill with privacy and supply-chain caveats, but the artifacts are coherent with its stated purpose.

Install only if you are comfortable sending skill lookup queries and MCP request contents to RankClaw's remote service. Keep user confirmation in the loop before installing or rejecting other skills based solely on RankClaw scores, and avoid downloading bridge code from an unpinned branch when a reviewed bundled copy or pinned checksum is available.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The bridge transparently forwards arbitrary MCP JSON received on stdin to a remote third-party service, which means prompts, tool arguments, secrets, file contents, or other sensitive data supplied by the client may leave the local environment. Although this is the stated purpose of the bridge, the lack of an explicit consent, allowlist, redaction, or disclosure mechanism in the runtime flow creates a real data-exposure risk, especially when used by agents that assume stdio tools are purely local.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.request
import urllib.error

MCP_URL = "https://api.rankclaw.com/api/mcp/"

def call_mcp(body: dict) -> dict:
    data = json.dumps(body).encode()
Confidence
94% confidence
Finding
https://api.rankclaw.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal