ClawHub
Back to skill

Security audit

java-code-review

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only GitLab code review helper with disclosed token use and optional merge actions that fit its stated purpose.

Install this only if you want the agent to review GitLab branches and potentially help merge them. Confirm the exact project, source branch, and target branch before approving any merge, use a limited-scope GitLab token, and keep generated CR reports private because they may include repository details and security findings.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
81% confidence
Finding
The activation scope is underspecified: the skill describes what it can do, including generating reports and performing merges, but does not define strict preconditions, boundaries, or non-trigger cases. In an agent environment, ambiguous activation rules are risky because they can cause the skill to run on loosely related prompts and proceed toward sensitive GitLab operations with insufficient user intent verification.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The activation scope is underspecified: the skill describes what it can do, including generating reports and performing merges, but does not define strict preconditions, boundaries, or non-trigger cases. In an agent environment, ambiguous activation rules are risky because they can cause the skill to run on loosely related prompts and proceed toward sensitive GitLab operations with insufficient user intent verification.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The document provides repository-state-changing GitLab API examples for creating and accepting merge requests and directly creating commits to merge branches, but it does not clearly warn that these operations modify source control state. In a skill that supports branch merge after user confirmation, omission of explicit safety boundaries increases the chance that an agent or user invokes destructive or premature merge actions without adequate review, confirmation, or environment scoping.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The authentication section shows realistic personal access token usage in headers, including a token-shaped example, without any warning that such credentials are sensitive secrets that must not be hardcoded, logged, or committed. In an agent skill context that interacts with GitLab, this can normalize unsafe secret handling and lead operators to embed long-lived tokens in scripts, prompts, or documentation-derived automation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.