ClawHub
Back to skill

Security audit

Script to Storyboard

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward local script-to-storyboard converter with expected file input and CSV output behavior.

Before installing, be aware that running the helper will read the script file you choose and write a CSV file at the output path you choose. Use a non-critical output filename to avoid overwriting files, and only process scripts you are comfortable giving to the local agent workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs use of `scripts/convert.py` and an output CSV path, which implies file read/write behavior, but no permissions are declared. Undeclared file capabilities can bypass user expectations and platform safety controls, especially if future code reads arbitrary local files or overwrites files via attacker-influenced paths.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The trigger conditions are broad, activating on generic mentions like 'storyboard' or 'script conversion' without clear scope boundaries. Over-broad triggers can cause unintended invocation on unrelated content, increasing the chance that sensitive user text is processed or transformed when the user did not intend to use this skill.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.