ClawHub
Back to skill

Security audit

draw-anything-with-datalink

Security checks for vulnerabilities and agentic risk

Overview

The skill coherently generates charts, with disclosed data-sharing behavior and an optional local renderer that needs ordinary package precautions.

Use hosted chart links only with data you can share with the service and link recipients; URLs and SVGs contain the underlying numbers. For confidential charts, use a reviewed local renderer. If choosing the CLI fallback, pin a reviewed package version and expect an initial download.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The chart-generation purpose is consistent, but the execution model materially differs. The supplied commands invoke executable package code and explicitly persist output files via --out; they do not demonstrate building x-cmd.com/draw URLs or embedding linked charts. These are concrete differences from the declared URL-only, no-install, no-stored-data workflow. The chunk does not establish unrelated access or data exfiltration.

Content

No source excerpt is available for this finding.

The skill does not warn users that chart URLs expose their underlying data to an external service and link recipients.

Medium
Category
Output Handling
Confidence
93% confidence
Finding

Chart labels and values are placed directly in URLs, so rendering sends them to the external service and sharing the URLs exposes them to recipients and potentially previews, caches, or logs. The skill openly describes URLs as self-describing, which reduces concealment concerns, but its statelessness assurances do not establish confidentiality or provide a sensitive-data safeguard.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @x-cmd/draw'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Although this is a chart CLI rather than an MCP server, unpinned npx @x-cmd/draw can download and execute a changing npm release with the agent's local permissions. A compromised release could access local files or credentials; the optional fallback limits exposure, but calling it 'no network' is misleading when the package is not already available locally.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @x-cmd/draw'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This ECharts example also invokes an unpinned npm CLI, allowing the executed package version to change without review. The inline JSON is not itself evidence of command injection, but a compromised package could execute arbitrary code with the agent's permissions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx @x-cmd/draw'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The PNG fallback repeats the same unpinned package-execution risk: npx may retrieve and execute a release that has not been reviewed. Writing a PNG is ordinary chart functionality, but it does not constrain what a malicious package could do under the agent's account.

Content

No source excerpt is available for this finding.