ClawHub
Back to skill

Security audit

Cloud Architecture Diagrams

Security checks across malware telemetry and agentic risk

Overview

This skill coherently generates editable cloud architecture diagrams and does not show malicious behavior, though users should be aware it can fetch and embed icon SVGs when given URL-based icons.

Install is reasonable for creating cloud diagrams. Use bundled provider icons where possible, avoid icon_url values from untrusted sources, and review generated .excalidraw/.drawio files before opening or sharing them if they include remotely fetched SVGs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The documentation claims icons are bundled offline, but also says diagram generation may fetch and embed Microsoft icons from msicons.com. This inconsistency can cause unexpected outbound network access and import remote content into generated files, weakening assumptions about offline operation, reproducibility, and supply-chain safety.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The script fetches arbitrary URLs from node['icon_url'] and from search results, then embeds the returned SVG/XML directly into generated .excalidraw and .drawio files. In this skill context, users are expected to open those files in rich desktop/web diagram tools, so untrusted remote content can become a supply-chain vector for SVG-based script injection, malicious XML payloads, privacy leaks, or SSRF-like internal network access when the tool is run in a sensitive environment.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.