ClawHub
Back to skill

Security audit

Wx Huitu

Security checks across malware telemetry and agentic risk

Overview

This appears to be a chart-rendering skill whose file creation, browser rendering, font fetching, and optional upload behavior fit its stated purpose.

Install this if you want an agent to generate rendered chart/image outputs. Before use, be aware it may run browser automation and write output files, and only allow cloud upload when you explicitly want the generated artifact shared.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases are generic chart-related commands that are likely to overlap with ordinary user requests, increasing the chance this skill is invoked when the user did not specifically intend to use it. In this skill, unintended invocation is more significant because the documented workflow includes local file writes, subprocess execution via Puppeteer, external font fetches, and optional cloud upload behavior, so accidental activation can cause side effects beyond simple text generation.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes generic phrases like “数据图” and “画个图表”, which are common in normal conversation and may activate the skill outside the user's intended context. Unintended activation matters here because the skill can generate files, invoke Puppeteer, access local browser binaries, and optionally upload outputs to cloud storage after follow-up interaction.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.