ClawHub
Back to skill

Security audit

CP控制计划技能

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent quality-control analysis helper that reads user-selected data files and writes local analysis outputs without hidden network, credential, or persistence behavior.

Before installing, treat uploaded or local quality datasets as potentially confidential, review the CSV/Excel file you pass to the scripts, and choose output paths intentionally so generated JSON and PNG files are stored where you expect.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs the agent to read user-supplied CSV/Excel files and write JSON/PNG outputs, but the skill metadata does not declare corresponding permissions or boundaries. This creates a capability/consent mismatch that can lead to unauthorized file access, unexpected writes, and reduced auditability when the skill is invoked.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The trigger conditions are broad enough to match many ordinary quality-assurance requests, which can cause the skill to activate in situations where users did not intend file processing, analysis, or artifact generation. Over-broad invocation increases the chance of unnecessary access to business data and accidental execution of higher-risk actions in mixed workflows.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill describes reading user-provided CSV/Excel files and writing analysis artifacts without clearly warning about local file access, output paths, or the sensitivity of manufacturing and quality data. This omission can cause users to expose confidential production data or allow outputs to be written to unintended locations without informed consent.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.