ClawHub
Back to skill

Security audit

Review Loop

Security checks across malware telemetry and agentic risk

Overview

The skill is not malicious, but it is labeled as read-only while its instructions can modify code, rerun tests, and commit changes.

Review this carefully before installing. It appears intended for iterative code review and remediation, but the publisher should either remove the read-only claim or split the review and fix/commit behavior. Install only if you are comfortable with an explicitly invoked skill causing code edits, test runs, subagent delegation, and commits in your repository.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest and description present the skill as a bounded, read-only review loop, but the body instructs the operator to implement fixes and rerun tests. This mismatch can mislead callers, policy systems, or reviewers into granting the skill broader trust than its actual behavior warrants, creating a pathway for unexpected code modification under a read-only label.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill says the spawned reviewer 'must only review,' but the overall workflow later permits accepted findings to be fixed by the operator or another subagent. While the contradiction does not itself grant code execution to the reviewer, it blurs the review-only boundary and can cause unsafe assumptions about what actions this skill may trigger in practice.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The manifest and metadata position this skill as a bounded, read-only review loop, but the default prompt instructs the agent to fix issues and commit changes. That mismatch can cause downstream systems or users to invoke the skill under the false assumption that it will not mutate the workspace, creating an authorization and trust-boundary violation.

Intent-Code Divergence

High
Confidence
96% confidence
Finding
The short description says the workflow is iterative no-fork review, fix, and commit, while the default prompt also directs fixing and committing, contradicting the broader skill metadata that describes a bounded read-only review loop. Contradictory documentation is dangerous because agents, reviewers, or policy enforcement layers may rely on the safer wording and permit a skill that actually encourages repository mutations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.