ClawHub
Back to skill

Security audit

garden-doctor

Security checks across malware telemetry and agentic risk

Overview

This skill is a local plant-diagnosis helper that matches symptoms to an embedded garden knowledge base and does not show hidden data access, network use, persistence, or destructive behavior.

Reasonable to install for garden troubleshooting. Treat its treatment advice as general gardening guidance: verify diagnoses, follow chemical product labels, test sprays on a small area, keep products away from children and pets, and consult a horticulturist or extension service for valuable, rare, edible, or commercial plants.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation shows shell execution capability via `python3 scripts/garden_doctor.py ...` examples, but no permissions are declared. Undeclared execution capabilities reduce transparency and can cause an agent platform or reviewer to underestimate what the skill can do, which becomes risky if the underlying script later executes commands, reads files, or accesses the environment.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The knowledge base recommends fungicides, bactericides, insecticides, miticides, neem oil, alcohol, and other treatment chemicals without any accompanying safety guidance such as following label directions, checking plant-specific compatibility, avoiding indoor misuse, or using protective equipment. In a consumer-facing diagnosis skill, users may act directly on these instructions and damage plants, pets, or themselves through misuse or overapplication.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.