ClawHub
Back to skill

Security audit

Build Plots

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent plotting helper; its main risks are ordinary dependency and browser-CDN trust considerations for optional Bokeh examples.

Install this only if you are comfortable with Python plotting dependencies from PyPI and optional Bokeh HTML that may load JavaScript from Bokeh's CDN. For stricter environments, pin patched dependency versions and regenerate or open only self-contained/static outputs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The HTML example loads and executes Bokeh JavaScript from an external CDN, which creates a supply-chain and network-trust dependency at view time. If the CDN response is tampered with, blocked, or replaced, anyone opening the example may execute unintended script in their browser, even though the skill’s core purpose is just to provide a visualization example.

Known Vulnerable Dependency: bokeh==3.4 — 2 advisory(ies): CVE-2026-21883 (Bokeh server applications have Incomplete Origin Validation in WebSockets); CVE-2026-21883 (Bokeh server applications have Incomplete Origin Validation in WebSockets)

Medium
Category
Supply Chain
Confidence
88% confidence
Finding
bokeh==3.4

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.