ClawHub
Back to skill

Security audit

Sharpagent Content Safety

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed content-safety instruction skill that may filter outputs and record safety decisions, with no executable code or hidden system access in the supplied artifact.

Install only if you want policy-based output filtering. Review or supply the actual rulesets before relying on it for compliance, make the active jurisdictions visible to operators, and set clear limits for safety-log storage and access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill explicitly describes detailed safety logging and archival storage of compliance events, including matched rules and jurisdictions, but does not mention data minimization, retention limits, access controls, or user disclosure. In a content-safety system, those logs can themselves contain sensitive metadata about user content, regulatory classification, or suspected policy violations, creating privacy and compliance risk if retained or broadly accessible.

Natural-Language Policy Violations

Medium
Confidence
81% confidence
Finding
The skill is designed to apply jurisdiction-specific blocking, including China-specific restrictions, and even defaults to loading global rules when no jurisdiction is configured, but it does not specify how jurisdiction is selected with user awareness or consent. This can lead to silent overblocking, policy misapplication, or censorship of content under the wrong legal regime, especially in multi-tenant or cross-border deployments.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.