ClawHub
Back to skill

Security audit

sev-attestation

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: run SEV-SNP attestation with expected privileged device access and AMD certificate lookups, with no hidden persistence or data theft found.

Install only if you administer an AMD SEV-SNP VM and intend to perform attestation. Expect to run local shell scripts, install third-party tools, grant root or sev-group access to /dev/sev-guest, and contact AMD KDS with chip-specific attestation data when fetching VCEK certificates. Before relying on a PASSED result to release secrets, verify the expected measurement, REPORT_DATA or nonce, debug policy, and acceptable TCB levels.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding
The skill invokes shell scripts and implicitly requires file access, but it does not declare those capabilities as permissions. That mismatch can cause the agent runtime or a human reviewer to underestimate the skill's access needs, which weakens trust boundaries and informed consent around executing local commands and reading sensitive host files like /dev/sev-guest or generated attestation artifacts.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The troubleshooting guide includes privileged commands and broad diagnostic reads without an explicit warning that they require elevated access and may expose sensitive system state or alter host configuration. In a security-focused attestation skill, users may copy-paste commands verbatim, so omission of safety guidance creates a real but low-severity operational risk rather than a direct exploit primitive.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The manual VCEK retrieval path sends attestation-derived identifiers and TCB values, including the chip-specific CHIP_ID, to AMD's remote KDS service without any user notice, consent gate, or offline alternative. In a remote attestation workflow this can leak a persistent hardware identifier and platform state to a third party, which creates privacy and tracking risk even though the endpoint is legitimate AMD infrastructure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.