ClawHub
Back to skill

Security audit

water-shutoff-map

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent home-plumbing preparedness tool that writes a local shutoff registry and gives purpose-aligned guidance, with practical safety cautions users should still read carefully.

Install only if you are comfortable maintaining a local household shutoff registry. Treat the plumbing procedures as preparation guidance: do not force corroded or stuck valves, do not operate shared building or municipal valves unless you are authorized, and call a plumber, landlord, building staff, or utility when in doubt.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises and instructs use of shell commands and writes a persistent registry file, but does not declare any permissions. Even though the behavior appears aligned with the skill's purpose, undeclared shell and file-write capabilities create a trust and containment gap: an agent or platform may permit actions the user did not explicitly approve, including overwriting arbitrary paths via `--file` or writing redirected output such as `> shutoff-card.txt`. In this context the content is not overtly malicious, but the missing permission declaration is still a real security issue because it weakens transparency and policy enforcement.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document gives step-by-step instructions to locate, test, close, reopen, and drain water shutoff valves, including mains, fixture stops, water heaters, and curb-side infrastructure, without a prominent upfront safety warning about flooding, valve seizure, scalding/hot-water risks, municipal restrictions, or when users should stop and call a plumber or building staff. In this context, a user may follow the guidance during an emergency or with little plumbing knowledge, increasing the chance of property damage, personal injury, or improper operation of building/utility equipment.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.