ClawHub
Back to skill

Security audit

RAGLite

Security checks across malware telemetry and agentic risk

Overview

This looks like a real RAG helper, but users should review it before trusting it with private documents because setup installs mutable remote code and the default workflow can use networked services.

Install only if you are comfortable with a dependency pulled from a live GitHub branch, or pin and audit it first. Before using this with medical records, personal notes, or internal documents, confirm where the OpenClaw gateway and Chroma server run, pass an explicit local/offline engine when needed, and avoid pointing it at broad private folders unless you understand what will be indexed and stored.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill presents itself as a local RAG helper, but the documented install path pulls and runs code directly from a remote GitHub repository (`git+https://...@main`) and relies on external components whose behavior is not visible in this skill file. That creates a supply-chain and transparency risk: users may trust the skill as a simple local data tool while it executes unpinned third-party code and uses a default external engine, which could change over time or handle sensitive documents in unexpected ways.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The install script pulls code directly from a mutable GitHub branch (`@main`) and installs it during setup, which defeats reproducibility and creates a supply-chain trust risk. If the upstream repository, account, dependency chain, or network path is compromised, users may execute attacker-controlled code simply by running the installer.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.