ClawHub
Back to skill

Security audit

Generate Mindmap

Security checks across malware telemetry and agentic risk

Overview

This looks like a legitimate mind-map generator, with disclosed cautions around local file writes and optional automatic Pillow installation for image export.

Install this if you want a local mind-map export tool and are comfortable with it creating output files. For shared, locked-down, or production Python environments, run with --no-auto-install and install Pillow yourself in a virtual environment. In Chrome or Edge, only bind autosave to HTML files you intend this tool to overwrite; otherwise use downloaded/exported copies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"--quiet", "--disable-pip-version-check"] + extra
        print(f"[mindmap] Pillow not found — running: {' '.join(cmd)}", file=sys.stderr)
        try:
            subprocess.check_call(cmd, stdout=subprocess.DEVNULL,
                                  stderr=subprocess.DEVNULL)
            break
        except (subprocess.CalledProcessError, FileNotFoundError):
Confidence
95% confidence
Finding
subprocess.check_call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises executable behavior that reads/writes files, accesses environment-dependent output paths, and invokes Python/shell tooling, but it does not declare corresponding permissions. This creates a trust and policy gap: users or calling systems may treat it as low-privilege content while it can modify local files and run package-management actions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The documented purpose focuses on mind-map generation/export, but the behavior extends to in-browser editing with persistent write-back to a chosen local HTML file and automatic pip installation. These side effects materially change the risk profile because they introduce file modification and environment mutation beyond simple content export.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The page uses the File System Access API to bind a user-selected local HTML file and then silently persists subsequent edits back to that same file via autosave. Even though the initial file selection requires user consent, this goes beyond a one-shot export and creates ongoing write capability to a local file, which increases the risk of unintended overwrites, confusing state changes, or abuse if untrusted content is later rendered in the page context.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The skill contains direct local file write logic that can repeatedly rewrite a chosen HTML file after edits, which is more powerful than ordinary diagram generation or image export. In a skill that may process user-provided or model-generated content, this elevates the consequence of mistakes or maliciously influenced edits because the tool can modify local artifacts persistently rather than just download a new export.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The page uses the File System Access API to obtain a writable handle and then can overwrite a user-selected local HTML file programmatically on later edits. Although the initial file selection requires user consent, subsequent automatic writes materially increase the risk of unintended data loss or silent modification of local files, especially because this artifact is presented as an export/view file rather than a local editor with privileged write-back behavior.

Context-Inappropriate Capability

Medium
Confidence
99% confidence
Finding
Auto-installing Python packages at runtime is risky because it downloads and executes third-party code during normal operation, expanding the trust boundary far beyond mind-map generation. In an agent/tooling context this is especially dangerous because a simple export request can trigger environment mutation, supply-chain exposure, and unexpected outbound network activity.

Vague Triggers

High
Confidence
84% confidence
Finding
The activation guidance is overly broad, directing the agent to use this skill for many generic requests involving structure, visualization, notes, or summaries. That increases the chance the skill is invoked in situations where users did not intend file generation, export, or local modifications, expanding exposure to the write and execution features.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs that after binding an HTML file, subsequent edits may automatically write back to that file, but this behavior is not presented as a prominent safety warning at the point of invocation. Silent or persistent file modification can surprise users and lead to unintended overwrites of local content.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill recommends or attempts automatic installation of Pillow via pip when missing, which modifies the user's Python environment and may have system-wide or workspace-wide effects. Even without using dangerous flags, unexpected package installation is a significant side effect that can break managed environments or violate user expectations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The page binds a local HTML file handle via the File System Access API and then silently persists later edits through `autosaveNow()` after many actions such as undo/redo, node creation, deletion, recoloring, and text edits. In a skill that renders user-provided content into an editable local document, automatic write-back increases the risk of unintended or coerced modification of a user-selected file without a fresh confirmation for each destructive change.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
After a file handle is bound, edits trigger delayed silent writes back to the chosen file without a contemporaneous confirmation at the moment of each save-triggering action. This is dangerous because users may reasonably treat the exported HTML as a portable viewer, not realize they are modifying a live bound file, and unintentionally persist destructive or sensitive changes to local content.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.