ClawHub
Back to skill

Security audit

Agent Heartbeat

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed monitoring tool, but it can run arbitrary configured shell commands on a recurring schedule and write results into the workspace.

Install only if you trust and review every heartbeat.yaml entry. Keep collectors read-only, avoid inline secrets, use least-privilege API keys, restrict destinations, and require human confirmation before any agent action that posts content, deletes data, changes accounts, spends money, or modifies important files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill instructs writing heartbeat results to a workspace file (`research/latest.md`) but does not warn that running the skill modifies local state. In agent environments, silent file writes can overwrite user data, pollute repositories, or trigger downstream automation that consumes the generated file.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages users to configure arbitrary shell commands and HTTP requests (`curl`, `find`, `awk`, custom `node` scripts) and automate them via cron, but it does not warn about command execution or external network access. In this context, that is dangerous because a heartbeat config can become a persistent execution mechanism that exfiltrates data, leaks secrets in headers, or runs unsafe commands on a schedule.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/heartbeat.js:89