ClawHub
Back to skill

Security audit

Nightscout-Local

Security checks across malware telemetry and agentic risk

Overview

This skill reads glucose data from a user-configured Nightscout site and shows no evidence of hidden writes, persistence, or data theft.

Configure NIGHTSCOUT_BASE_URL or pass --url for your own Nightscout site before use, and treat glucose readings shown in the agent conversation as sensitive health data. Do not use the referenced current_bg.py helper unless you inspect that separate local script first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes Python scripts that read an environment variable and make outbound network requests, but the skill metadata does not declare those capabilities. Undeclared env/network access weakens policy enforcement and user/operator visibility, which can lead to unintended data exposure or execution in contexts that assumed the skill was inert or fully constrained.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.