ClawHub
Back to skill

Security audit

爱图表 桑基图

Security checks across malware telemetry and agentic risk

Overview

The Sankey skill is mostly coherent, but its bundled API script exposes unrelated project-generation commands and stores an API key persistently, so it should be reviewed before installation.

Install only if you are comfortable giving this publisher an aitubiao API key and letting the skill create projects through that account. Prefer a low-privilege or throwaway API key if the service supports it, rotate the key if exposed in chat logs, and review any agent action that calls create-chart, create-ppt, create-3d, or writes downloads outside a user-approved folder.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The CLI is marketed as a Sankey-diagram skill but exposes materially broader capabilities: quota inspection, generic chart creation, PPT generation, 3D illustration creation, and project export/download. In an agent-skill setting, this violates least privilege and expands what the agent can do with the user's credentials and local environment beyond the declared purpose, increasing the risk of misuse or unauthorized actions.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The presence of `create-ppt` and `create-3d` gives this Sankey skill the ability to invoke unrelated remote content-generation workflows under the same API key. In context, that is dangerous because an agent or prompt injection could steer execution into capabilities the user did not authorize when enabling a Sankey-only skill.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
`download-project` can write server-supplied exports to arbitrary local paths chosen at invocation time, giving this skill a broad file-output primitive unrelated to basic Sankey generation. In an agent context, arbitrary local file writes increase the blast radius of prompt injection or accidental misuse, even though the code does some directory and file-format checks.

Ssd 3

Medium
Confidence
97% confidence
Finding
The skill explicitly asks the user for an API key and stores it in `~/.aitubiao/credentials` with cross-session persistence. Soliciting raw secrets through the conversation and persisting them locally creates a significant credential-theft and unintended reuse risk, especially if the environment is shared, logged, or later accessed by other skills/processes.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.