ClawHub
Back to skill

Security audit

md2wechat

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed md2wechat CLI guide with clear limits around previews, drafts, uploads, and provider use.

Before installing, confirm you expect the agent to use the md2wechat CLI for WeChat article formatting and related draft, image, title, or humanizing workflows. Treat upload, draft creation, and remote image generation as actions that should only happen after you ask for them, and review local md2wechat configuration before using publishing features.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill description is extremely broad and includes generic writing, title suggestion, discovery, and AI-trace-removal tasks, which can cause the agent to invoke this skill for many loosely related requests. That increases the chance of unintended command execution paths, including generation or draft-related workflows, in contexts where the user did not specifically ask to use this CLI or where a narrower skill would have been safer.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.