ClawHub
Back to skill

Security audit

Flagrelease Entrance Flagos

Security checks across malware telemetry and agentic risk

Overview

This skill openly describes a GPU-container LLM deployment pipeline, and its Docker, package install, model download, and benchmarking actions fit that purpose.

Install only if you intend to run an LLM deployment and benchmarking workflow inside a known GPU Docker container. Confirm the container name and model path, use a disposable or recoverable non-production container, and review the referenced sibling skills because they contain the detailed package installation and test logic this orchestrator will follow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to run Docker inspection commands, copy scripts into a running container, download models, and install multiple packages, but it does not explicitly warn the user that these actions modify the container and may execute untrusted code or change the runtime environment. In an agent setting, omission of this warning can lead to unsafe consent and unexpected execution against the wrong container or a sensitive environment, especially because the pipeline chains several invasive steps automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.