ClawHub
Back to skill

Security audit

minor-detection

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it sends sensitive conversation and profile data to configured remote services with limited scoping or redaction controls.

Review before installing. Use only with classifier and embedding endpoints you trust, dedicated low-privilege API keys, and data you are allowed to send off-device. Expect chats, identifiers, profile context, and some user-derived text to appear in remote requests and local stderr logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The normalizer includes `raw_payload_json` containing a verbatim serialization of the entire inbound payload, even though the module is described as only extracting and restructuring selected fields. In a security-sensitive pipeline, this can unnecessarily retain and propagate sensitive data from conversations, profiles, metadata, or tokens into downstream logs, storage, or model inputs, increasing privacy and data-exposure risk.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The pipeline packages and sends full conversation content plus request_id, sample_id, and user_id to an external classifier API. This creates a clear data exfiltration/privacy risk, especially because the payload may contain sensitive personal information and there is no minimization, redaction, consent, or purpose limitation enforced in this code path.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The function sends both `raw_response_text` and `normalized_payload` to a remote model during schema repair. If those fields contain personal, sensitive, or proprietary data, this creates a real confidentiality risk because internal data is transmitted off-process without any minimization, redaction, or explicit trust boundary enforcement in this code path.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The retriever sends conversation-derived text to a remote embeddings endpoint via `httpx` using a configurable `base_url`, which can expose potentially sensitive user content to an external service. In a retrieval layer handling conversations, this is a real privacy and data-governance risk when there is no visible consent check, minimization, redaction, or allowlisted destination control in this code path.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.