ClawHub
Back to skill

Security audit

Volcengine Skills Finder

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly coherent, but it can install new agent skills globally and from alternate sources without a clear confirmation checkpoint.

Review this before installing because it can change your agent's installed skills, defaults to global installation, and can install from a non-default source if directed. Use dry-run or project scope where possible, and only use alternate sources you already trust.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
return
    if shutil.which("npx") is None:
        fail("npx executable not found; install Node.js to install skills")
    completed = subprocess.run(command, capture_output=True, text=True, check=False)
    if completed.returncode != 0:
        detail = completed.stderr.strip() or completed.stdout.strip()
        fail(f"skills CLI install failed: {detail}", completed.returncode)
Confidence
91% confidence
Finding
completed = subprocess.run(command, capture_output=True, text=True, check=False)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read local files and invoke shell commands (`python3`, `npx`, and `skills` CLI) but does not declare any permissions or trust boundaries. That creates a real least-privilege and transparency problem: a caller may invoke what appears to be a simple discovery skill, yet it can perform local installation actions and execute package-manager-backed commands, increasing the chance of unintended code execution or environment modification.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The default prompt directs the agent to use this skill whenever current capabilities are 'insufficient,' which is vague and expansive. Broad activation conditions can cause unnecessary marketplace browsing or installation behavior, increasing the chance of inappropriate skill invocation, prompt-routing abuse, or unreviewed capability expansion in sensitive workflows.

Unvalidated Output Injection

High
Category
Output Handling
Content
if isinstance(item, dict) and isinstance(item.get("name"), str)
        }

    completed = subprocess.run(command, capture_output=True, text=True, check=False)
    if completed.returncode != 0:
        detail = completed.stderr.strip() or completed.stdout.strip()
        fail(f"unable to list installed skills: {detail}", completed.returncode)
Confidence
78% confidence
Finding
subprocess.run(command, capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
return
    if shutil.which("npx") is None:
        fail("npx executable not found; install Node.js to install skills")
    completed = subprocess.run(command, capture_output=True, text=True, check=False)
    if completed.returncode != 0:
        detail = completed.stderr.strip() or completed.stdout.strip()
        fail(f"skills CLI install failed: {detail}", completed.returncode)
Confidence
80% confidence
Finding
subprocess.run(command, capture_output

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.