ClawHub
Back to skill

Security audit

AIEOS (AI Entity Object Specification)

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed persona-management skill that can persistently change an agent’s identity files when the user explicitly runs its commands.

Install only if you want a skill that can manage persistent agent persona files. Use dry-run first, inspect imported JSON carefully, avoid schemas from unknown URLs, back up IDENTITY.md, SOUL.md, and aieos/entity.json before using --apply, and review generated HTML before publishing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises commands that can read environment-linked workspace paths, fetch remote content, and write local files, but it does not declare corresponding permissions. This creates a trust and review gap: operators may approve or install the skill without realizing it can import remote persona data and overwrite identity-related files in the workspace.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The documented behavior goes beyond a passive schema framework and includes downloading remote schemas, persisting full persona blueprints, overwriting local identity files, exporting internal persona data, and generating public HTML output. That mismatch increases the chance of unsafe use because users may not anticipate state-changing, exfiltration-adjacent, or publication-oriented actions from the description alone.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The tool includes a feature to generate a public-facing HTML page containing persona identity, origin, residence, and profile details, which expands the data exposure surface beyond core schema management. In this skill context, persona data may contain sensitive or user-linked attributes, so producing publication-ready output without strong warnings or redaction controls can leak private information.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Fetching schemas from arbitrary URLs introduces network-based trust and lets the tool ingest untrusted remote content directly into identity files. In this context the remote schema is not merely validated structurally; its contents are later persisted and rendered, so a malicious source can poison local persona files or supply data that leads to downstream injection issues.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The usage text mentions `--apply` commits changes, but it does not clearly warn that this writes and may overwrite persona files in the workspace. In a skill centered on identity/persona control, silent or under-emphasized persistence is risky because a user may unintentionally alter long-lived behavioral configuration.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.