Is skill/runtime-debug-skill safe?
https://clawhub.ai/skill/runtime-debug-skill
This skill is a sophisticated application debugging tool that instruments applications to collect runtime data, but poses significant security risks through its design to transmit application data to external services. While it may have legitimate debugging uses, the broad application instrumentation and external data transmission create serious data exfiltration risks.
Category Scores
Findings (5)
CRITICAL Application Runtime Data Transmitted to External Services -90 ▶
The skill is explicitly designed to instrument applications and send their runtime data, including potentially sensitive information like database queries, API calls, and internal application state, to external servers at api.syn-cause.com.
HIGH External Code Download and Execution -70 ▶
The skill downloads and executes installation scripts from external GitHub repositories, which could be modified to include malicious code. It also uses hardcoded GitHub tokens to access private repositories.
HIGH Application Code Modification 0 ▶
The skill modifies critical application files including dependency manifests and entry points, injecting instrumentation code that fundamentally alters application behavior.
MEDIUM Legitimate Cover for Data Exfiltration -75 ▶
The debugging functionality provides perfect cover for malicious data exfiltration, as sending detailed application runtime data appears necessary for the stated debugging purpose.
MEDIUM Extensive Behavioral Control Instructions -25 ▶
The skill contains detailed instructions that override normal agent behavior with rigid 4-phase process requirements and multiple 'STOP' commands that could interfere with user intentions.