ClawHub
Back to skill

Security audit

vocab-cards-lite

Security checks across malware telemetry and agentic risk

Overview

This skill is a local flashcard image generator with expected file output behavior, but its dependency setup should be run in an isolated Python environment.

Install this only in a virtual environment or other isolated Python environment, review the unpinned dependencies before use, and expect that the advertised bundled fonts may be missing so system font setup may be required.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The setup script invokes pip with --break-system-packages, which explicitly bypasses protections intended to prevent modification of the system Python environment. This can overwrite or conflict with OS-managed packages and create reliability or security maintenance issues, especially when users run the script with elevated privileges or on shared systems.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pillow
fonttools
qrcode[pil]
Confidence
98% confidence
Finding
pillow

Unpinned Dependencies

Low
Category
Supply Chain
Content
pillow
fonttools
qrcode[pil]
Confidence
97% confidence
Finding
fonttools

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
pillow

Known Vulnerable Dependency: fonttools — 4 advisory(ies): CVE-2023-45139 (fonttools XML External Entity Injection (XXE) Vulnerability); CVE-2025-66034 (fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.v); CVE-2023-45139 (fonttools XML External Entity Injection (XXE) Vulnerability) +1 more

High
Category
Supply Chain
Confidence
93% confidence
Finding
fonttools

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.