ClawHub
Back to skill

Security audit

Svg2pptskill

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward connector to Handbooks' SVG-to-PPT service, with the main caveat that conversion inputs and the provided API key are sent to handbooks.cn.

Install only if you are comfortable sending the SVG content, SVG URL, map or character request, and your Handbooks API key to handbooks.cn for conversion. Avoid using it for confidential diagrams, internal URLs, or proprietary SVGs unless that service is acceptable for your data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs sending user-provided SVG content, URLs, and an API key to a third-party service, but it does not clearly warn that the submitted data leaves the local environment or describe how that external service will store, process, or retain it. This creates a real privacy and secret-handling risk, especially if users paste sensitive SVGs, internal URLs, or reusable API keys assuming the conversion is local or first-party.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.