ClawHub
Back to skill

Security audit

AI PPT generate

Security checks across malware telemetry and agentic risk

Overview

This appears to be a Baidu PPT-generation skill that uses your Baidu API key and sends PPT inputs to Baidu as expected.

Install this only if you are comfortable sending PPT topics, generated outlines, and any referenced document or template URLs to Baidu/Qianfan. Use a dedicated Baidu API key where possible, keep it out of prompts and logs, and avoid confidential or regulated documents unless your organization approves that use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill requires environment access for BAIDU_API_KEY and performs network calls to external Baidu endpoints, but it does not declare these capabilities as permissions. This creates a transparency and policy gap: agents or users may invoke a networked, credential-using skill without clear consent boundaries or review of what external access is required.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs operators to provide a sensitive BAIDU_API_KEY and sends user content and optional resource URLs/files to Baidu, but it gives no user-facing warning about external transmission, retention, or safe credential handling. This can lead to unintended disclosure of sensitive prompts, documents, or metadata to a third party without informed consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.