ClawHub
Back to skill

Security audit

Narrator

Security checks across malware telemetry and agentic risk

Overview

This screen narration skill is purpose-aligned, but it delegates real execution to an unbundled local repo with screen/API-key access, so users should review it before installing.

Install only if you trust and have inspected the separate /Users/buddy/narrator checkout. Run it with sensitive windows closed, use scoped API keys where possible, avoid exposing unrelated secrets in the environment, and stop the tmux session when narration is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill exposes shell execution behavior and use of sensitive environment variables, but it does not declare permissions in a security-facing way that would let users or a platform evaluate those capabilities up front. Because it launches local commands, uses tmux, and relies on API keys for external services, the undeclared capability surface increases the chance of unexpected command execution and data handling without informed consent.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill wrapper delegates execution to an external local repository at /Users/buddy/narrator rather than containing the operative logic in the reviewed artifact, so the real runtime behavior is opaque and cannot be bounded by this file. That mismatch is dangerous because a user may approve a seemingly narrow screen-narration skill while actually executing arbitrary broader code from an unreviewed local codebase with access to shell, screen content, API keys, and local files.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This file is effectively a thin launcher for code in /Users/buddy/narrator rather than the reviewed skill implementation itself, which defeats transparency and makes security review of the shipped skill incomplete. In a security-sensitive agent ecosystem, delegating all behavior to an out-of-tree local repository creates an opaque trust boundary where unreviewed code can perform any actions under the guise of the declared screen-narration skill.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The code executes an external local codebase via subprocess, giving that code full execution with the user's environment and working directory assumptions, while the visible skill file itself contains no substantive narration logic. Because the delegated repository is outside the reviewed artifact, an attacker who can modify that local path or substitute its contents can gain arbitrary code execution under the trusted skill entrypoint.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
This skill file delegates all runtime behavior to an external local repository outside the reviewed skill boundary, meaning the effective code being run is unpinned and invisible to this analysis. That creates a significant trust-boundary problem: the skill can execute arbitrary behavior from /Users/buddy/narrator while presenting itself as a simple screen-narration launcher.

Intent-Code Divergence

Low
Confidence
73% confidence
Finding
The header comments frame the file as a compatibility shim while hiding that all meaningful behavior is delegated to code outside this skill. That mismatch reduces auditability and can mislead operators or reviewers about what code is actually trusted and executed, increasing the chance that unsafe external behavior bypasses review.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
This skill narrates live screen activity using Gemini vision and ElevenLabs, which strongly implies that screenshots or screen-derived content may be transmitted to third-party cloud services, yet the documentation does not clearly warn users of that data flow. In the context of live desktop capture, this is especially sensitive because screens often contain credentials, private messages, financial data, or internal documents that could be exfiltrated unintentionally.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
cmd = [str(python_bin), '-m', 'narrator']
    cmd.extend(sys.argv[1:])

    env = os.environ.copy()
    # Make sure package imports are resolved from repo checkout.
    env['PYTHONPATH'] = str(repo_dir)
Confidence
92% confidence
Finding
os.environ.copy()

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal