Meme Generator

Security checks across malware telemetry and agentic risk

Overview

This looks like a low-risk meme text utility, though one bundled helper script has generic local data/logging commands that users should notice.

This skill appears safe for generating meme text. Before installing, be aware that one included helper script is a generic local data utility and can save entered text under ~/.local/share/meme-generator by default; do not put sensitive information into it unless you are comfortable with that local storage.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

A user may see or invoke extra commands that do not directly generate meme text, which could be confusing.

Why it was flagged

This bundled script exposes generic local utility commands beyond the meme-specific commands described in the skill, although the actions shown are local and low impact.

Skill content
Commands:\n  run                  Execute main function\n  config               Configuration\n  status               Show status\n  init                 Initialize\n  list                 List items\n  add                  Add entry\n  remove               Remove entry\n  search               Search\n  export               Export data
Recommendation

Use the meme-specific commands intentionally and review the helper script behavior before relying on generic add/list/export functions.

#
ASI04: Agentic Supply Chain Vulnerabilities
Info
What this means

It may be harder to verify the publisher or compare this artifact to an upstream project.

Why it was flagged

The registry metadata does not provide a source or homepage, even though SKILL.md includes author/source claims; this is a provenance gap rather than evidence of malicious behavior.

Skill content
Source: unknown\nHomepage: none
Recommendation

If provenance matters, verify the listed author/source information outside the skill before installing.

#
ASI06: Memory and Context Poisoning
Low
What this means

If you enter private text into the helper commands, it may be stored locally in data.log or history.log.

Why it was flagged

The helper script creates a persistent local directory and logs command activity/data, so user-provided text may remain on disk.

Skill content
DATA_DIR="${MEME_GENERATOR_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/meme-generator}"\nDB="$DATA_DIR/data.log"\nmkdir -p "$DATA_DIR"\n_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }
Recommendation

Avoid entering sensitive information, set MEME_GENERATOR_DIR to a location you control if needed, and clear the data directory when finished.