ClawHub
Back to skill

Security audit

Macvital

Security checks across malware telemetry and agentic risk

Overview

This is a local Mac health-check skill whose command execution and optional sudo temperature check fit its disclosed purpose, though users should be careful with admin prompts and process details.

Install only if you want a local macOS diagnostics helper. Prefer non-sudo status/check/top commands for routine checks, avoid sharing detailed output if process names or system details are sensitive, stop watch mode when finished, and approve sudo only when you specifically requested temperature data.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run(cmd, timeout=10):
    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout, shell=isinstance(cmd, str))
        return r.stdout.strip()
    except Exception:
        return ''
Confidence
95% confidence
Finding
The helper executes any string command with shell=True, which creates a shell-injection sink if untrusted input ever reaches cmd. In this file, get_disk(path) interpolates a function argument into a shell command, so a crafted path could execute arbitrary commands under the agent's user context.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Temperature only (more accurate with sudo)
python3 scripts/macvital.py temp
sudo python3 scripts/macvital.py temp

# Exit code check (for scripting: 0=ok, 1=warn, 2=critical)
python3 scripts/macvital.py check
Confidence
78% confidence
Finding
The skill explicitly instructs users or agents to run the temperature command with `sudo`, which elevates execution to root. Even though the stated purpose is legitimate hardware monitoring, encouraging privileged execution increases risk because any flaw in `scripts/macvital.py` or its subprocess usage would run with full system privileges, and agents may normalize unnecessary elevation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.