ClawHub
Back to skill

Security audit

图纸对比审核技能

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently parses user-provided 2D drawings and 3D models to create local comparison reports, with no evidence of hidden network, credential, persistence, or destructive behavior.

Before installing, be aware that the skill processes the local CAD/PDF/model files you provide and writes local feature and report files. Use it only on intended project files, and review reports before sharing because they may contain file paths and design details.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill instructs the agent to read user-supplied local files and write output reports, which are code-capable operations, but it does not declare any permissions or constraints for those file accesses. This creates an authorization gap: an agent or runtime may perform file I/O beyond the intended project files, especially because the inputs are arbitrary relative paths and outputs are written to the working directory.

Static analysis

No suspicious patterns detected.