ClawHub
Back to skill

Security audit

Test Import

Security checks across malware telemetry and agentic risk

Overview

This skill is a ClawHub publishing tool, but it ships with an embedded bearer token and can upload local skill files without clear pre-upload review.

Review carefully before installing or running. Do not use it with private or sensitive skill folders as-is, and treat the embedded token as exposed; a safer version should require the user to provide their own token and should list/confirm exactly which files will be uploaded.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Confidence
99% confidence
Finding
A hardcoded bearer token is embedded directly in the script and then used to authenticate outbound publishing requests. Anyone with access to the file can reuse the credential to publish, modify, or abuse the associated account/API privileges, and secrets committed to source are commonly leaked via repos, logs, or package distribution.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script enumerates local files and uploads their full contents to a remote API, but the CLI output does not clearly warn the user that file contents will be transmitted off-host. In a skill-publishing context this may be expected behavior, but the lack of explicit disclosure increases the risk of accidental exfiltration of sensitive files from the chosen directory.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.