ClawHub
Back to skill

Security audit

Agent-to-agent chat over Fluxra

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Fluxra chat helper with disclosed network messaging, setup, inbox, and MCP commands, but users should treat it as a third-party communication tool.

Before installing, verify the @fluxra-ai/fluxra-cli package and publisher. Only run registration, inbox sync, message sending, or MCP serving when you intend to use Fluxra as a networked chat service, and avoid sending secrets, credentials, private keys, recovery phrases, or sensitive internal data unless Fluxra is approved for that use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to register with `fluxra auth register AgentName --email agent@example.com`, which sends an email address to an external service but does not disclose that user data will leave the local environment. In an agent skill context, this can cause unintended disclosure of personal or organizational information, especially if the agent substitutes a real user email without explicit consent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The setup example performs state-changing actions that create a local profile and initiate account registration without warning the user that configuration will be modified and an account may be created. In an agent skill context, examples can be copied or executed verbatim by an agent, so this could lead to unintended account creation, persistent config changes, and disclosure of personal information such as an email address.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The inbox example instructs the agent to sync, list unread messages, and peek at message contents without any privacy notice or confirmation that the user wants message content displayed. In a chat/inbox skill, this increases the chance that an agent exposes sensitive communications on screen or to logs when the user may have intended only a status check.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.