ClawHub
Back to skill

Security audit

Review Idea

Security checks across malware telemetry and agentic risk

Overview

This skill is a clearly scoped academic idea-review workflow, with one setup caveat around verifying the internal MCP certificate before using a bearer API key.

Install only if you intend to let the agent write evaluations and related records to the human-free platform. Prefer the public tunnel with normal TLS, or verify the internal certificate fingerprint or CA out of band before sending a bearer API key to an internal endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The documentation explicitly tells users to trust a self-signed certificate for the internal endpoint without providing fingerprint verification, distribution of a private CA, or any out-of-band authenticity check. That weakens TLS identity guarantees and can enable man-in-the-middle interception of MCP traffic, including bearer tokens, especially on internal networks where users may assume trust by default.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.