ClawHub
Back to skill

Security audit

iBlipper Expressive Typography - Remember reading is automatic!

Security checks across malware telemetry and agentic risk

Overview

This skill mostly does what it says, but its helper script can run unintended local code when given a specially crafted message.

Review before installing. Basic link generation is aligned with the skill’s purpose, but avoid running scripts/iblipper.sh on untrusted or copied message text until the encoder is fixed to pass text as an argument or via stdin. Do not put sensitive text in generated links, since recipients load an external renderer and the text can be exposed through the link and browser context.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to generate and open external URLs and to download rendered GIFs from a third-party site, which is network-capable behavior despite no declared permissions. This creates a trust and transparency gap: agents or reviewers may not realize the skill depends on external network access, and any compromise or content change on the hosted site could affect users or lead to unintended data disclosure through URL parameters.

Context-Inappropriate Capability

Low
Confidence
97% confidence
Finding
The script interpolates untrusted user input directly into a Python one-liner inside double quotes: python3 -c "... '''$text''' ...". Because shell expansion happens before Python runs, crafted input containing quotes or command substitution syntax can break out of the intended Python string and trigger arbitrary shell command execution, making this far more severe than merely invoking an external interpreter.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.