ClawHub
Back to skill

Security audit

Cloud Security Posture

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate cloud security audit skill, but it should be reviewed because it overstates read-only safety while asking for broad cloud access and handling sensitive IAM data.

Review before installing or using in production. Use narrowly scoped read-only cloud credentials, avoid granting GCP Storage Admin unless truly required, and treat AWS credential reports as sensitive security data that should not be broadly logged, pasted, or stored.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The document states that all commands are read-only, but it includes `aws iam generate-credential-report`, which initiates report generation and therefore changes service state. While the action is low-risk and administrative rather than destructive, the inaccurate safety claim can mislead an agent or operator into executing a command they would otherwise review more carefully.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
`aws iam get-credential-report` retrieves a sensitive account-wide report containing security-relevant metadata such as MFA status, access key age, and last login details. In a security assessment skill this command is contextually legitimate, but omitting a warning about the sensitivity of the output increases the risk of overcollection, insecure handling, or disclosure of privileged identity data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.