ClawHub
Back to skill

Security audit

书匠

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Chinese romance-writing workflow that creates project files, uses public web sources, and runs basic shell utilities, with no evidence of hidden exfiltration or destructive behavior outside its project folder.

Install only if you are comfortable with a writing workflow that creates a timestamped project folder, writes multiple local artifacts, may overwrite manuscript files inside that project, browses public novel-ranking sites, and runs basic shell utilities such as `mkdir`, `wc`, `cat`, `tee`, `rg`, and possibly `curl`. Keep sensitive files outside the project folder and review generated logs/context snapshots before sharing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The agent is a manuscript quality inspector, but it is granted powerful capabilities including shell execution, web/browser access, editing, and sub-agent invocation. That tool set violates least privilege and creates unnecessary pathways for data exfiltration, destructive file modification, prompt-injection pivoting from reviewed content, or execution of attacker-influenced commands.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The file claims a workspace boundary limited to the project root, but later mandates shell commands such as `wc -m {小说标题}-正文.md` and related file operations without a concrete enforcement mechanism. If the filename or title is attacker-controlled, this can enable path traversal or shell argument injection, undermining the stated boundary and potentially exposing or operating on unintended files.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill is explicitly designed to create a folder and write JSON files into the workspace, but the user-facing metadata does not clearly warn that local filesystem changes will occur. This can lead to unexpected persistence of scraped data and silent modification of project state, which is a genuine safety issue even though writes are constrained to the project root.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to always create or overwrite `{小说标题}-正文.md`, and optionally `{小说标题}-番外篇.md`, without requiring confirmation that overwriting is safe. In an agentic environment with file write tools, this can destroy prior drafts or user-authored content if the title collides with an existing file, causing irreversible data loss within the project workspace.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.