ClawHub
Back to skill

Security audit

cx

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent guide for using a code-navigation CLI, with disclosed setup commands that users should review before running.

Before installing, prefer the brew or cargo commands when available. If using the curl-to-shell installer, review the script source first and understand it executes code locally. Expect cx to create local cache/index data for projects it inspects, and use cache cleaning only when you are comfortable rebuilding that state.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The markdown instructs users to run a `curl ... | sh` installer, which downloads and immediately executes a remote shell script. This is a safety-sensitive operation affecting system integrity, but the document provides no warning to review the script, verify its source, or understand that it will execute code on the user's machine.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The troubleshooting guidance tells users to run `cx cache clean`, which appears to be a deletion-oriented maintenance command. The markdown does not warn that this action may remove cached state or require re-fetching/re-indexing afterward, so users are not informed of the data-affecting behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.