ClawHub
Back to skill

Security audit

Using Agent Skills Router

Security checks across malware telemetry and agentic risk

Overview

This is a text-only routing helper that guides skill selection and does not request credentials, run code, or persist anything.

Reasonable to install as a lightweight routing aid. It can influence which later skill an agent chooses, so still review any selected skill or command before allowing sensitive, destructive, production, financial, or credential-related work.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Do not turn small fixes into a full spec-plan-build-review cycle.
- Do not load long reference files just to decide whether a skill applies.
- Do not role-play multiple agents when the runtime cannot actually isolate their work.
- Do not ask the user which skill to use when local context makes the choice clear.
Confidence
80% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.