ClawHub
Back to skill

Security audit

OpenStoryline Install

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward OpenStoryline installer with disclosed setup steps, though users should protect any API keys written to its config file.

Install only if you trust the upstream FireRed-OpenStoryline project. Review requirements.txt and download.sh before running them, approve any sudo/package-manager commands explicitly, keep services bound to 127.0.0.1 unless external access is intended, and treat API keys in config.toml as secrets that should not be committed, shared, or logged.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This markdown file includes direct commands to set llm.api_key and vlm.api_key in a local configuration file, but it does not warn that this stores sensitive credentials on disk or advise users to protect the file. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or privacy.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.