ClawHub
Back to skill

Security audit

createrepo

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only RPM repository management skill with disclosed, purpose-aligned commands, though some deletion examples should be handled carefully.

Install only if you expect to manage RPM/YUM/DNF repositories. Before running any deletion command, confirm the resolved path, list wildcard matches, and consider moving files aside instead of deleting them. Protect signing keys and avoid disabling GPG checks except for temporary local testing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill includes destructive file deletion examples (`rm -rf` and `rm`) in troubleshooting guidance without explicit warnings, validation steps, backups, or guardrails. In an agent skill context, users or downstream automation may copy these commands with substituted paths, making accidental data loss more likely even though the documented target is repository metadata or packages rather than arbitrary system paths.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.