ClawHub
Back to skill

Security audit

solution-case-finder

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed PatSnap TRIZ case-search helper that sends user-provided search criteria to a fixed external endpoint and does not show hidden persistence or destructive behavior.

Before installing, users should understand that technical search prompts are sent to PatSnap/Eureka RD and should avoid submitting trade secrets, NDA-protected details, personal data, or export-controlled material. The shell helper uses curl and jq to contact a fixed hosted endpoint; review that dependency fit for your environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to execute shell commands (`bash scripts/mcp_http.sh ...`, `curl`, `jq`) but does not declare corresponding permissions. That mismatch is dangerous because an orchestrator or reviewer may treat the skill as low-privilege while it actually performs networked command execution, increasing the chance of unintended command use and reducing security visibility.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.