ClawHub
Back to skill

Security audit

inference-aiops

Security checks across malware telemetry and agentic risk

Overview

This skill is openly designed for GPU inference operations, but it exposes high-impact write actions without an enforceable read-only mode or approval gate.

Install only if you are prepared to scope the connected Ray/vLLM environment yourself. Prefer read-only network access by default, use narrowly scoped credentials, and expose write-capable endpoints only when the operator intends the agent to perform production changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Authorization is not this tool's job — decide it where it belongs

Whether a write should happen is your decision, or the environment's. The tool
does not gate it — there is no read-only switch and no approval prompt to
configure. The two right places to control read vs write:

- **The environment you connect it to.** Restrict the network path so the tool
Confidence
95% confidence
Finding
The document explicitly states that the tool has no read-only switch and no approval prompt, and instead relies on external environment controls or the agent's prompt to prevent write actions. In an agentic setting, prompt-only restrictions are weak and can be bypassed or ignored, so exposing write-capable endpoints can allow the model to perform disruptive operations such as scale-to-zero, drain, undeploy, or job submission without an in-tool authorization barrier.

Session Persistence

Medium
Category
Rogue Agent
Content
## Governance & Safety

The skill delivers reads and writes and records them; it does **not** decide
whether a write is permitted. That is your agent's judgement, or the permission
of the environment you connect it with (a network path that only reaches the
read/metrics endpoints, a Ray dashboard without its job-submission API — writes
then fail at the server). There is no read-only switch, policy file, or approval
Confidence
94% confidence
Finding
The skill explicitly states it provides write operations but has no read-only switch, approval gate, or authorization layer, and that enforcement is left to the surrounding agent or server environment. In an agent context, this is dangerous because a compromised prompt flow, tool-selection mistake, or weakly protected Ray/vLLM endpoint could allow destructive actions such as scale-to-zero, undeploy, drain, restart, or job cancellation with only audit-after-the-fact controls.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/agent-guardrails.md:42