ClawHub
Back to skill

Security audit

Awesome Repo Builder

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a normal awesome-list repository generator that creates local scaffold files and does not show hidden credential, persistence, or exfiltration behavior.

Install this only if you want an agent to research a topic and create local repository files. Use a dedicated empty output directory, review the generated README, AGENTS.md, templates, and verify_urls.py before publishing, and use --force only when you intentionally want scaffold files overwritten.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill instructs the agent to read local references, write a repository scaffold, and perform topic research, which implies file read, file write, and network access. Those capabilities are consistent with the feature set, but they are undeclared, so users and policy enforcement layers cannot accurately scope or constrain what the skill may do. In a skill that performs external research and creates files, missing permission declarations increase the risk of unintended data access, unsafe overwrites, or unreviewed outbound requests.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.