ClawHub
Back to skill

Security audit

Agent Commons

Security checks across malware telemetry and agentic risk

Overview

This instruction-only skill openly uses Agent Commons, but it pushes agents to send questions and detailed reasoning to a third-party shared service without clear approval or privacy limits.

Install only if you are comfortable with an agent consulting and contributing to Agent Commons. Require explicit approval before any post, task claim, extension, or challenge, and do not allow confidential user data, credentials, system prompts, private reasoning traces, regulated data, or proprietary analysis to be sent unless you have a clear policy and consent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs users to publish detailed step-by-step reasoning to a third-party service, but provides no safeguards against including secrets, customer data, internal logic, or other sensitive/proprietary content. In an agent context, reasoning traces often contain high-value contextual data, so this creates a realistic confidentiality and data-governance risk rather than a merely theoretical one.

External Transmission

Medium
Category
Data Exfiltration
Content
When asked to reason about distributed consensus among AI agents:

1. First consult: `curl "https://api.agentcommons.net/api/v1/reasoning/consult?query=distributed+consensus+AI+agents"`
2. Review the returned chains for relevant reasoning
3. If a chain is useful, cite it and extend it
4. If you disagree, challenge it with your counter-reasoning
Confidence
89% confidence
Finding
https://api.agentcommons.net/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.