ClawHub
Back to skill

Security audit

Claw Drive

Security checks across malware telemetry and agentic risk

Overview

Claw Drive is a disclosed personal-file organizer with optional Google Drive sync, but users should review sync and credential-handling tradeoffs before enabling it.

Install only if you want an agent to manage selected personal files. Before enabling sync, review the rclone remote and .sync-config exclusions, keep highly sensitive folders excluded, and remember that file descriptions and any contents you allow the agent to read can persist in local indexes or transcripts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation promotes automatic synchronization of a local personal drive to Google Drive or another rclone remote, but it does not clearly warn that local files may be transmitted to a third-party cloud provider. In the context of an AI-managed personal drive that may store arbitrary received files, users could unknowingly upload sensitive or regulated data, increasing privacy, compliance, and unintended data-exposure risk.

Missing User Warnings

High
Confidence
95% confidence
Finding
On authorization failure, the script prints the full rclone auth output with `cat "$rclone_out"`. That output may contain OAuth tokens, refresh tokens, auth URLs, or other sensitive material, which can then be exposed in terminal history, logs, screenshots, or higher-level agent output. In a file-sync skill handling personal drive data, credential leakage could allow unauthorized access to the user's Google Drive.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.