ClawHub
Back to skill

Security audit

Local Coding

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only local AI coding skill with disclosed local routing and no evidence of hidden, destructive, or exfiltrating behavior.

Reasonable to install if you want a local AI router for coding. Verify the `ollama-herd` package and publisher before installing, use it only on trusted local networks, and avoid sending secrets in prompts because local traces or logs may remain under `~/.fleet-manager/`.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill is marketed as a local coding assistant, but the documented capabilities also include general-purpose chat, image generation, and speech-to-text. This scope expansion can mislead users and higher-level agents into granting broader access than expected, increasing the chance of unsafe or unintended use of the local model fleet.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.