ClawHub
Back to skill

Security audit

B3ehive

Security checks across malware telemetry and agentic risk

Overview

This skill is not malware, but it can present a preselected placeholder code winner as if it were objectively evaluated.

Install only if you treat this as a prototype/template generator. Do not rely on its automatic winner, comparison report, or rationale as objective; review all generated implementations yourself and verify or replace the missing command entry point before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The script claims to perform objective, score-based winner selection, but actually hardcodes `winner="a"` and generates reports asserting a data-driven evaluation process that never occurred. This is a software integrity issue because downstream users may trust the delivered result and accompanying documentation as unbiased when the selection was predetermined, enabling silent manipulation of outputs and audit deception.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.