ClawHub

Generate Mindmap

Security checks across malware telemetry and agentic risk

Overview

This mind-map skill does what it says, but it can automatically install Pillow into the user's Python environment during normal PNG/JPG/PDF export.

Review before installing. Use it in a virtual environment or preinstall Pillow through your normal dependency process, and avoid letting the skill auto-run pip on shared, locked-down, or system Python environments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
pass
    print("[mindmap] Pillow not found, installing automatically …", file=sys.stderr)
    try:
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "pillow", "--quiet",
             "--disable-pip-version-check", "--break-system-packages"],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
Confidence
97% confidence
Finding
subprocess.check_call( [sys.executable, "-m", "pip", "install", "pillow", "--quiet", "--disable-pip-version-check", "--break-system-packages"], stdout=subp

subprocess module call

Medium
Category
Dangerous Code Execution
Content
except (subprocess.CalledProcessError, FileNotFoundError):
        # Retry without --break-system-packages (older pip)
        try:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", "pillow", "--quiet",
                 "--disable-pip-version-check"],
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
Confidence
97% confidence
Finding
subprocess.check_call( [sys.executable, "-m", "pip", "install", "pillow", "--quiet", "--disable-pip-version-check"], stdout=subprocess.DEVN

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises no declared permissions, yet the documentation clearly instructs shell execution, environment/path use, and writing files into the workspace. This creates a transparency and policy gap: the runtime capabilities are broader than the declared security surface, which can lead to over-trusting the skill and unintended command execution or file creation.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior exceeds the stated purpose by including runtime package installation and richer browser/editor features not disclosed in the top-level description. This mismatch is dangerous because reviewers and users may approve a seemingly simple export skill while it actually performs dependency changes and potentially broader execution paths.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Automatically running `pip install pillow` at runtime modifies the execution environment and introduces network/package-supply-chain risk without clear necessity or consent. Even a common package install can fail unpredictably, pull compromised dependencies, or violate locked-down environments.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
A mind-map generator should not silently install packages as part of normal operation; doing so exceeds the minimally necessary behavior for the advertised functionality. In a privileged agent context, this creates an unnecessary supply-chain and environment-integrity risk because package installation executes code and alters the runtime without explicit approval.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger phrases are broad and conversational, such as requests to 'visualize' or 'organize structure', which increases the chance of unintended invocation. In an agent setting, accidental invocation can cause unnecessary file generation, shell execution, or package installation when the user did not explicitly request this skill.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation explicitly instructs automatic package installation without warning or consent. This is risky because it normalizes a side effect that changes the host environment, potentially bypassing user expectations and organizational controls around software installation.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Automatic package installation without explicit consent is unsafe operational behavior for an agent skill because it surprises the operator and changes the host state. In this context, the skill is supposed to generate files, not perform package management, so the mismatch makes the behavior more dangerous than it would be in a dedicated installer utility.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal