ClawHub
Back to skill

Security audit

mock

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Mock/RPM build skill that fits its stated purpose, but its privileged setup and lower-trust build examples need careful use.

Install only if you understand Mock’s local privileges. Avoid passwordless sudo unless necessary, restrict mock group membership to trusted users, keep GPG checks enabled for production or trusted builds, and treat external repositories or network-enabled builds as lower-trust options.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The skill markets Mock as providing a clean and secure build environment, but the included custom configuration later enables network access inside the chroot via rpmbuild_networking=True and use_host_resolv=True. That mismatch can mislead users into assuming builds are isolated when build scripts may fetch remote content, exfiltrate data, or produce non-reproducible artifacts.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The examples include cleanup commands such as --scrub=all and cache removal operations without an explicit warning that they will delete cached packages and build state. In operational environments, users may run these commands blindly and lose forensic data, cached dependencies, or local build artifacts, causing disruption.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation instructs users to modify group membership and sudoers configuration, including a NOPASSWD rule for /usr/bin/mock, without clearly warning about the privilege and persistence implications. This can weaken local privilege boundaries and normalize broad administrative changes in environments where multiple users share build hosts.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal