ClawHub
Back to skill

Security audit

供应商来料质量专项分析

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent local Excel quality-analysis tool, but its generated HTML report can render spreadsheet-derived text as active HTML, which creates a script-injection risk when reports are opened.

Install only if you trust the Excel sources or are comfortable treating generated HTML reports as untrusted files. Prefer viewing the Markdown output or sanitizing/escaping report fields before sharing or opening HTML reports from supplier-provided data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The template renders each conclusion with Jinja's safe filter, which disables HTML escaping for content that may originate from users, upstream data, or LLM-generated text. In an HTML report context this can enable stored or reflected XSS, including script injection, event handlers, malicious links, or data-exfiltrating markup when the report is viewed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.