ClawHub
Back to skill

Security audit

cn-time-parser

Security checks across malware telemetry and agentic risk

Overview

This skill locally parses Chinese date and time phrases, and its code matches that purpose with only ordinary npm dependency caveats.

Install only if you are comfortable running npm dependencies for date, lunar-calendar, and holiday logic. Prefer installing from the included lockfile, and pass only the text needed for time parsing since the skill activates on broad time-related Chinese phrases.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Unpinned Dependencies

Low
Category
Supply Chain
Content
"test": "node scripts/parse-time.js --query '今天'"
  },
  "dependencies": {
    "dayjs": "^1.11.10",
    "lunisolar": "^2.0.2",
    "argparse": "^2.0.1",
    "chinese-workday": "^1.11.0"
Confidence
91% confidence
Finding
"dayjs": "^1.11.10"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "dayjs": "^1.11.10",
    "lunisolar": "^2.0.2",
    "argparse": "^2.0.1",
    "chinese-workday": "^1.11.0"
  },
Confidence
91% confidence
Finding
"lunisolar": "^2.0.2"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "dayjs": "^1.11.10",
    "lunisolar": "^2.0.2",
    "argparse": "^2.0.1",
    "chinese-workday": "^1.11.0"
  },
  "keywords": ["time", "parser", "chinese", "lunar"],
Confidence
91% confidence
Finding
"argparse": "^2.0.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dayjs": "^1.11.10",
    "lunisolar": "^2.0.2",
    "argparse": "^2.0.1",
    "chinese-workday": "^1.11.0"
  },
  "keywords": ["time", "parser", "chinese", "lunar"],
  "author": "",
Confidence
92% confidence
Finding
"chinese-workday": "^1.11.0"

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.