ClawHub

Fluid Network Solver

Security checks across malware telemetry and agentic risk

Overview

This appears to be a normal data-analysis skill with expected local file input and report output behavior, but users should note the broad file-handling workflow and unpinned Python dependencies.

Install in a project-specific environment, review the input and output paths before running, avoid feeding sensitive data unless needed, and consider pinning or locking the Python dependencies for reproducible use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding
The skill documentation instructs the agent to read input files and write reports/JSON outputs, but it does not declare corresponding permissions. This creates a mismatch between the stated capability surface and the permission model, which can lead to unintended file access or writes if the runtime relies on explicit declarations for policy enforcement or user awareness.

Unpinned Dependencies

Low
Category
Supply Chain
Content
scipy>=1.11
networkx>=3.2
tomli>=2.0; python_version < "3.11"
Confidence
90% confidence
Finding
scipy>=1.11

Unpinned Dependencies

Low
Category
Supply Chain
Content
scipy>=1.11
networkx>=3.2
tomli>=2.0; python_version < "3.11"
Confidence
90% confidence
Finding
networkx>=3.2

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal