ClawHub
Back to skill

Security audit

Local ContextBridge 中文

Security checks across malware telemetry and agentic risk

Overview

This skill has a legitimate local-document search purpose, but it needs review because it can install a third-party package, index private/internal files, run a local service, and encourages low-friction searches with weak consent and privacy warnings.

Install only if you trust the cbridge-agent package and want an agent-accessible local document index. Add narrowly chosen folders, avoid highly sensitive directories, review watched folders regularly, and use remove/stop controls when the index or service is no longer needed. Treat returned snippets and file paths as private data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill is described as a local search capability, but the documentation instructs the agent to install, initialize, and manage third-party software (`pip install`, `cbridge init`, watch folders, indexing). That expands the skill from passive retrieval into software deployment and local filesystem monitoring, creating supply-chain, privacy, and unauthorized system-modification risks well beyond the stated purpose.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The documentation claims the tool is 'open source trusted' and has 'no data leakage risk' while instructing installation from PyPI/GitHub. Such absolute safety claims can mislead users and agents into lowering scrutiny despite the real risks of third-party packages, dependency compromise, telemetry, or unintended document exposure through indexing and logs.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger description is broad enough to match ordinary conversations about local files, private data, or internal knowledge, which increases the chance of invoking the skill without sufficiently specific user intent. In this skill's context, accidental activation is more dangerous because the tool can search sensitive local documents and return excerpts and file paths.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description omits key warnings that it may scan local documents, build indexes of their contents, and return file paths alongside excerpts. Without clear notice and consent, users may unknowingly expose sensitive personal or corporate information, and path disclosure can reveal usernames, project names, or confidential directory structures.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.