ClawHub
Back to skill

Security audit

Model Verify Flagos

Security checks across malware telemetry and agentic risk

Overview

This skill performs a coherent model-verification workflow, but it defaults to running code from user-supplied model repositories without a clear warning or opt-in.

Install only if you intend to run this in an isolated, disposable container and will use trusted, vetted model repositories or local model paths. Treat any remote model ID as a possible code source because the workflow enables remote-code execution by default.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The skill explicitly passes --trust-remote-code when loading a user-specified local or remote model, which permits execution of model-supplied Python code inside the container. Because the model source is user-controlled and may come from HuggingFace or ModelScope, this turns a verification workflow into arbitrary code execution with the container's privileges, potentially enabling data exfiltration, credential theft, or lateral movement.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs downloading a user-specified remote model and later executing it with trust-remote-code, but it provides no explicit warning that third-party model repositories may contain executable code or that downloads may expose metadata and pull unreviewed content into the environment. In this context, the absence of warning increases the chance that operators will run untrusted models in sensitive containers without understanding the code-execution and privacy risks.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.