ClawHub
Back to skill

Security audit

TIFF Merge & Split

Security checks for vulnerabilities and agentic risk

Overview

This is a local TIFF image utility with no evidence of hidden network access, credential use, or destructive behavior.

Install only if you intend to process local image files with this skill. Confirm the exact input and output paths before running it, and treat the TIFF split feature as incomplete until the author fixes it to actually write PNG/JPG files.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The natural-language examples are broad, conversational commands that could overlap with ordinary user requests and cause the skill to be invoked unintentionally by an agent platform. In a file-processing skill, unintended invocation can lead to unexpected local file access, file creation, or transformation of user data without sufficiently explicit consent.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill advertises very generic natural-language triggers such as '帮我把这几张图片合并成 TIFF' and '帮我生成一个 TIFF 文件，包含这些图片', which are close to ordinary user phrasing and may cause the skill to activate unintentionally. Overly broad triggers can lead to incorrect routing, unexpected file operations on local user content, and interference with other skills handling images or documents.

Static analysis

No suspicious patterns detected.