ClawHub
Back to skill

Security audit

故障树分析技能

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward fault-tree analysis skill that uses local helper scripts to process user-provided files and produce requested analysis outputs.

Install this if you need local fault-tree analysis. Use it with FTA JSON/YAML files you trust, choose output paths deliberately, and be cautious opening generated HTML reports from untrusted imported data because report text is inserted into HTML output.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read and write local files and invoke scripts, but it declares no corresponding permissions or capability boundaries. This creates a mismatch between documented behavior and security controls, increasing the chance that the agent can access or modify files without explicit authorization or review.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger conditions are broad enough that ordinary requests about failures, reliability, or reports could invoke this skill unintentionally. Over-broad activation can expose file-processing and script-execution paths in situations where they are unnecessary, increasing attack surface and the risk of unsafe handling of user-supplied data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.