ClawHub
Back to skill

Security audit

百度网盘文档扫描官方Skill

Security checks across malware telemetry and agentic risk

Overview

This skill sends user-provided images to Baidu's scan service for documented image cleanup tasks and saves processed results locally.

Install only if you are comfortable sending the selected image to Baidu's scan service. Avoid using it on highly sensitive IDs, receipts, or private documents unless that service is acceptable for your data, protect the BDPAN_API_KEY, and periodically delete generated files from /tmp.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
75% confidence
Finding
The script transmits potentially sensitive image contents from stdin to an external API and includes an API key in the request URL, but the code provides no user-visible disclosure, consent, or guardrails. In a document/image processing skill, users may pass IDs, receipts, or other sensitive scans, so silent transmission to a third party creates a real privacy and credential-handling risk.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.