ClawHub

Nova Canvas

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AWS Bedrock image generator, but users should avoid putting AWS secrets directly on the command line.

Install only if you intend to use AWS Bedrock/Nova Canvas and accept possible AWS charges. Prefer an AWS profile, SSO, or a least-privilege role over passing access keys in prompts or command lines, and choose output paths carefully because generated files may overwrite existing files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documents capabilities that require reading environment variables and making outbound AWS network calls, but it does not declare permissions accordingly. This weakens least-privilege controls and can cause the skill to access ambient credentials or network resources without clear user or platform visibility, which is especially relevant because the skill supports multiple AWS authentication paths.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly encourages passing AWS access keys and secret keys directly as command-line arguments and advertises multiple credential-handling methods without a strong warning about secret exposure. Command-line secrets can leak via shell history, process listings, logs, transcripts, or agent/tool telemetry, creating a substantial risk of credential compromise and downstream AWS account abuse.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal