ClawHub
Back to skill

Security audit

Image Generation

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent image and diagram workflow with local-only interactive diagram tooling and no evidence of hidden remote data transfer or malicious behavior.

Install only if you want local diagram-generation and export helpers. For interactive diagrams, keep the server bound to 127.0.0.1, use unique session IDs, avoid placing secrets in diagram labels, and clear temp session files if the diagram content is sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The page automatically restores state via fetch() and opens a persistent EventSource connection on load without any explicit user disclosure, opt-in, or clear indication of what data is being synchronized. In an interactive diagram/editor context, this can expose diagram contents, editing activity, and session identifiers to a backend unexpectedly, which is a real privacy and transparency issue even though the code appears intended for legitimate collaboration or state sync.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.