ClawHub
Back to skill

Security audit

Meta Control - Agent Orchestration

Security checks across malware telemetry and agentic risk

Overview

This appears to be a broad meta-orchestration skill that is not clearly malicious, but it can delegate browsing, script execution, automation, and background monitoring without enough user-facing limits.

Install only if you want a high-autonomy coordinator. Before using it, require explicit confirmation before spawning child agents, running scripts, crawling sites, or starting monitoring, and keep background tasks visible and easy to stop.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill describes broad orchestration of complex tasks and delegation to background child agents without clear activation boundaries, approval gates, or task-type restrictions. This can cause the agent to over-apply the skill in situations where users did not clearly consent to autonomous decomposition and delegated execution, increasing the chance of unintended actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill explicitly contemplates child agents that crawl websites, run scripts, and perform continuous monitoring in the background, but the description does not clearly warn users that these potentially sensitive actions may occur. In an orchestration context, hidden or under-disclosed background execution is dangerous because it can lead to unauthorized automation, privacy issues, and persistent activity without informed user consent.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The description states the skill is a general-purpose orchestrator for sub-agents but provides no activation boundaries, allowed actions, or safety constraints. In an agent system, overly broad orchestration scope can enable unintended delegation, excessive privilege use, or unsafe invocation in contexts the author did not explicitly limit.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.