ClawHub
Back to skill

Security audit

Cad To Data

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims: help convert user-selected CAD/BIM files into structured outputs, with local file and converter use disclosed.

Install only if you are comfortable letting the agent read local CAD/BIM files and create structured exports. Use trusted local converter tools, give explicit input and output paths, avoid overwriting important files, and treat generated exports as potentially sensitive project data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill includes an export_to_json function that writes extracted CAD/BIM content directly to disk without any warning, consent flow, or guidance about handling sensitive project data. CAD/BIM files can contain building layouts, room data, infrastructure details, and other confidential metadata, so encouraging raw export increases the risk of inadvertent data leakage or persistence in insecure locations.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill explicitly supports exporting extracted data to Excel, CSV, or JSON and notes that filesystem write permission is required, but it does not warn about where files will be created, whether existing files may be overwritten, or how output paths are chosen. In an agent setting, this can lead to unintended file creation or destructive overwrites of user data, especially if the user supplies ambiguous or sensitive paths.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal