ClawHub
Back to skill

Security audit

Robotaxi Briefing

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed news-briefing workflow that uses public web sources and narrowly scoped local report files for 24-hour comparison.

Install this if you are comfortable with the skill fetching public web/news sources and maintaining a rolling set of robotaxi briefing files. Keep separate copies if you need reports older than 24 hours for audit or archival purposes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Low
Confidence
87% confidence
Finding
The skill instructs deletion of files via `find ... -delete`, which is a destructive capability affecting persistent local data. Although scoped to old report files, destructive filesystem actions increase risk because path mistakes, naming collisions, or future edits could remove data beyond what the user expects, and the deletion is not essential to producing the briefing itself.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill performs irreversible cleanup of historical reports without any user-facing warning or consent. Even if limited to files older than 24 hours, silent deletion can cause unintended data loss, hinder auditing of prior outputs, and make recovery difficult if reports were needed for verification or compliance purposes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.