ClawHub
Back to skill

Security audit

decision-gate

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local audit-log helper that writes tamper-evident decision records and does not show hidden network, credential, destructive, or persistence behavior.

Before installing, choose a dedicated log path, protect it with normal filesystem permissions, and avoid putting secrets or unnecessary personal data in action_id, evidence_classes, source_refs, or outcome_ref fields. The log is tamper-evident, not a complete policy enforcement system.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill declares no permissions, yet its documented behavior explicitly relies on environment-variable access and reading/writing a local append-only log file. This mismatch is dangerous because it hides the skill's real capabilities from operators and policy systems, making it easier to deploy in contexts where file or environment access should be reviewed or denied.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.