ClawHub
Back to skill

Security audit

TinyTroupe Feed Research Lab

Security checks across malware telemetry and agentic risk

Overview

This skill is a local draft-research helper that reads user-provided content and writes local reports, with no evidence of hidden network access, credential use, or destructive behavior.

Install only if you are comfortable running a local Python script on your draft content. Use a private output directory, review generated reports before sharing them, and remember the results are synthetic research signals rather than predictions about X reach or ranking.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation instructs the agent to run a local Python script and states that it writes multiple output files, but the skill declares no permissions. That mismatch can cause the execution environment or reviewer to underestimate the skill's filesystem access, reducing transparency and weakening policy enforcement around file reads and writes.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.