ClawHub
Back to skill

Security audit

Enterprise AI Landing Guide

Security checks across malware telemetry and agentic risk

Overview

This skill sends user-provided business information and optional files to a disclosed external API to generate an AI adoption map, with consent gates before human review or contact sharing.

Before installing, confirm you are comfortable sending business process details and any explicitly selected attachments to the listed external HTTPS service. Do not upload trade secrets, regulated personal data, or files you are not authorized to share; only use the FDE review and contact options after reviewing the consent language.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no explicit permissions even though it clearly relies on environment variables, file access to local references/examples, and outbound network calls to an external API. This weakens platform-level security review and consent boundaries because operators and users cannot accurately see the skill's effective capabilities before execution.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
The upload command transmits arbitrary local file contents to a remote API immediately, without any inline warning, preview, or confirmation step. In a skill context where users may not expect local file exfiltration from a helper client, this increases the risk of accidental disclosure of sensitive enterprise documents.

Missing User Warnings

Medium
Confidence
74% confidence
Finding
The consent-related CLI path collects and submits contact and company information but does not provide an explicit disclosure in the client UX about what fields are transmitted and for what purpose. This can lead to unintended sharing of personal or business data, particularly in enterprise environments with strict data handling expectations.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.