ClawHub
Back to skill

Security audit

Skill Market Publisher

Security checks across malware telemetry and agentic risk

Overview

This skill is a legitimate publishing helper, but live use can submit your skill content and contact details to public marketplaces.

Install only if you intend to publish skills publicly. Before using --execute, review the generated bundle and dry-run output, confirm the exact marketplace and repository scope, remove secrets or proprietary content from SKILL.md, use a public contact address where possible, and do not pass custom CLI binary flags unless you trust the executable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
dry_run_output("clawhub", command)
        return {"dry_run": True, "command": command}

    result = subprocess.run(
        command,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
Confidence
88% confidence
Finding
result = subprocess.run( command, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

subprocess module call

Medium
Category
Dangerous Code Execution
Content
with tempfile.TemporaryDirectory(prefix="skills-sh-publish-") as temp_dir:
        temp_path = Path(temp_dir)
        result = subprocess.run(
            command,
            cwd=temp_path,
            stdout=subprocess.PIPE,
Confidence
92% confidence
Finding
result = subprocess.run( command, cwd=temp_path, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,

subprocess module call

Medium
Category
Dangerous Code Execution
Content
]
    for prefix, probe in candidates:
        try:
            result = subprocess.run(
                [*base_command, *probe],
                capture_output=True,
                text=True,
Confidence
90% confidence
Finding
result = subprocess.run( [*base_command, *probe], capture_output=True, text=True, timeout=10, check=False,

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly instructs the operator to run local Python scripts, read and write bundle files, use repository paths, and contact external marketplaces, which implies shell, filesystem, environment, and network access. Because these capabilities are not explicitly declared, a caller may invoke the skill without understanding that it can exfiltrate repository data or perform live submissions to third-party services, creating a real transparency and authorization gap.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The code explicitly checks for telemetry-blocking and CI-related environment variables and refuses to proceed unless anonymous telemetry can be emitted by the third-party CLI. In a publishing skill, this is more dangerous because it intentionally nudges execution toward external data transmission from the host environment without a prominent consent step at runtime.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
At execution time, the skills.sh publish path proceeds once telemetry blockers are absent, but it does not present an explicit user-facing warning or consent step immediately before causing telemetry-bearing CLI execution. In this skill's context, which publishes local skill metadata to external services, silent or weakly signaled telemetry makes privacy and data-governance risks more significant.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.