ClawHub
Back to skill

Security audit

Prompt injection detection skill

Security checks across malware telemetry and agentic risk

Overview

This is a coherent moderation skill that runs a local shell helper to send checked text to HuggingFace and optionally OpenAI for safety classification.

Install only if you are comfortable sending moderated input, and optionally draft output, to HuggingFace and OpenAI. Use scoped API keys, avoid sending secrets or regulated data unless approved, and make sure failed or unavailable API checks are treated as an unavailable signal rather than proof that content is safe.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documentation instructs users to invoke `scripts/moderate.sh`, which implies shell execution capability, but no permissions are declared. This creates a trust and enforcement gap: a platform or reviewer may treat the skill as low-privilege while it actually depends on command execution and outbound API use, increasing the risk of unexpected script execution or policy bypass.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends the full user-provided text to Hugging Face and OpenAI moderation endpoints without any runtime notice, consent check, or data-minimization step. In a content-moderation skill this may be expected behavior, but it still creates a real privacy and data-handling risk because sensitive prompts, secrets, or regulated data can be exfiltrated to third-party services implicitly.

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Layer 1: Prompt injection detection (input only) ──

if [ "$DIRECTION" = "input" ] && [ -n "${HF_TOKEN:-}" ]; then
  HF_RESPONSE=$(curl -sf \
    "https://router.huggingface.co/hf-inference/models/$MODEL" \
    -X POST \
    -H "Authorization: Bearer $HF_TOKEN" \
Confidence
93% confidence
Finding
curl -sf \ "https://router.huggingface.co/hf-inference/models/$MODEL" \ -X POST \ -H "Authorization: Bearer $HF_TOKEN" \ -H 'Content-Type: application/json' \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
# ── Layer 2: Content moderation (both directions, optional) ──

if [ -n "${OPENAI_API_KEY:-}" ]; then
  OAI_RESPONSE=$(curl -sf \
    "https://api.openai.com/v1/moderations" \
    -X POST \
    -H "Authorization: Bearer $OPENAI_API_KEY" \
Confidence
94% confidence
Finding
curl -sf \ "https://api.openai.com/v1/moderations" \ -X POST \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H 'Content-Type: application/json' \ -d

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.