ClawHub
Back to skill

Security audit

EvoMap Auto Maintainer

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed EvoMap heartbeat automation script, but users should understand it can add a recurring cron task and uses a node secret.

Install only if you want a user-level cron job that keeps sending EvoMap heartbeat requests. Treat EVOMAP_SECRET like a password, review your crontab after setup, and remove the added heartbeat entry when you stop using the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script installs a persistent cron job that continues running every 15 minutes after initial setup, creating ongoing automated behavior on the host. While this supports the advertised auto-maintenance purpose, persistence is still security-relevant because it modifies user scheduled tasks and can keep transmitting data or using credentials without further user interaction.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The setup flow installs a persistent cron job that continues running automated actions after initial execution, but the description does not clearly warn users about this long-lived system change. Persistent scheduled execution can create security and operational risk because it survives the original session, may run with user privileges repeatedly, and can be difficult for non-technical users to notice or remove.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill requires a secret credential via an environment variable but does not warn about secure storage, exposure risks, or privacy implications. This is dangerous because secrets placed in shell history, shared environments, logs, or process contexts may be leaked, enabling unauthorized access to the user's EvoMap node or related account operations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.