ClawHub
Back to skill

Security audit

报表官-图表生成

Security checks across malware telemetry and agentic risk

Overview

This appears to be a chart/spreadsheet helper that generates code for the user to review and run, with disclosure gaps but no evidence of hidden execution, exfiltration, persistence, or deception.

Install only if you want help generating spreadsheet/chart automation. Treat any VBA, Office Script, or platform script it outputs as executable code: review it first, run it on a copy of the file when possible, and avoid pasting it into sensitive or production spreadsheets unless you understand the changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The natural-language triggers are broad enough that ordinary requests like '帮我画个柱状图' or '生成图表代码' could invoke this skill outside a clearly scoped workflow. Because this skill emits executable spreadsheet/macros/script code for external tools, unintended activation increases the chance of generating code a user may paste and run without understanding the risks.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill description says it returns code that can be directly pasted into Excel/WPS/钉钉/腾讯文档, including VBA, Office Scripts, and macro-like scripts, but it does not clearly warn that these outputs are executable and may modify files, sheets, formulas, or automation state. In this context, users may treat the output as harmless visualization content when it is actually runnable code, increasing the risk of unsafe execution.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.