ClawHub
Back to skill

Security audit

过程能力分析技能

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent quality-analysis tool that reads user-provided data and writes requested reports or charts, with no evidence of hidden network, credential, destructive, or deceptive behavior.

Install this only if you need process-capability or quality-control analysis. Provide data files and output paths intentionally, and avoid pointing outputs at important existing files because the scripts can write or overwrite requested report/chart files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs execution of local scripts that read input files and export results to disk, including writing XLSX and image outputs, but it declares no permissions or constraints around file writes. This creates a mismatch between documented capabilities and declared security posture, which can lead to unintended file creation or overwriting if the skill is invoked in an automated environment.

Vague Triggers

Medium
Confidence
73% confidence
Finding
The trigger conditions are broad enough to match generic quality-analysis requests, so the skill could activate when a user did not intend to invoke a script-running, file-processing workflow. In context this is not directly malicious, but over-broad triggering increases the chance of unintended tool use, file access, or result generation in mixed-skill environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.