ClawHub
Back to skill

Security audit

Rvt To Excel

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward local Revit export helper that runs a dedicated exporter and writes conversion outputs, with no evidence of hidden data transfer or persistence.

Before installing, confirm you trust the bundled or required RvtExporter.exe and review output paths when exporting, especially in batch runs where existing files could be overwritten.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Low
Confidence
90% confidence
Finding
This markdown file describes file-generating behavior such as exporting sheets to PDF and later shows writing `elements.csv`, but it does not explicitly warn users that running the workflow will create or overwrite local files. For a skill that affects user data and filesystem state, a brief disclosure in the documentation would improve safety and user awareness.

Unvalidated Output Injection

High
Category
Output Handling
Content
if options:
            cmd.extend(options)

        result = subprocess.run(cmd, capture_output=True, text=True)

        if result.returncode != 0:
            raise RuntimeError(f"Export failed: {result.stderr}")
Confidence
85% confidence
Finding
subprocess.run(cmd, capture_output

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.