ClawHub
Back to skill

Security audit

Chart Image

Security checks across malware telemetry and agentic risk

Overview

This skill makes chart image files locally and does not show hidden data theft, destructive behavior, or unauthorized persistence.

Reasonable to install for normal chart generation. Keep --spec, --csv-file, and --output paths controlled by the runtime, avoid rendering untrusted raw Vega-Lite specs, and keep the npm dependencies updated with the lockfile.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The script accepts arbitrary Vega-Lite specs from --spec files or stdin and renders them directly, which exceeds a narrowly-scoped 'generate chart images from data' capability. In an agent setting, this broadens the trusted input surface and can enable unsafe spec features, unexpected resource consumption, or behavior not intended by the skill manifest.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill reads arbitrary local paths via --spec and --csv-file using readFileSync without constraining where files may be loaded from. In an agent environment, an attacker who can influence arguments may coerce the skill into accessing sensitive local files, potentially exposing secrets or internal data through errors, downstream rendering, or agent-mediated output.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to auto-select dark mode based on local time and specifically references Israel time without user opt-in. This can cause unauthorized locale/timezone inference or hard-coded regional behavior, leading to privacy leakage, incorrect outputs for users in other regions, and policy-breaking context assumptions by the agent.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"name": "chart-image-scripts",
  "type": "module",
  "dependencies": {
    "vega": "^5.30.0",
    "vega-lite": "^5.21.0",
    "sharp": "^0.33.0"
  }
Confidence
93% confidence
Finding
"vega": "^5.30.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"type": "module",
  "dependencies": {
    "vega": "^5.30.0",
    "vega-lite": "^5.21.0",
    "sharp": "^0.33.0"
  }
}
Confidence
89% confidence
Finding
"vega-lite": "^5.21.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "vega": "^5.30.0",
    "vega-lite": "^5.21.0",
    "sharp": "^0.33.0"
  }
}
Confidence
89% confidence
Finding
"sharp": "^0.33.0"

Known Vulnerable Dependency: vega==5.30.0 — 3 advisory(ies): CVE-2025-59840 (Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in enviro); CVE-2025-27793 (Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]); CVE-2025-26619 (Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode express)

High
Category
Supply Chain
Confidence
98% confidence
Finding
vega==5.30.0

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.