ClawHub
Back to skill

Security audit

Folder Icon

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says, but it changes Windows folder icon files and attributes and downloads icon assets, so it should be run only on folders the user chooses.

Install only if you are comfortable with a skill that modifies selected Windows folders by writing icon files and desktop.ini, changing folder attributes, and downloading SVG icon data from external icon repositories. Prefer dry-run first, use trusted target directories, and consider local or pinned icon assets if network supply-chain risk matters.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no permissions even though it clearly performs sensitive actions: reading and writing files, invoking shell/VBScript/attrib, accessing environment/runtime context, and downloading remote SVG content. Missing permission disclosure is dangerous because users and orchestrators cannot accurately assess or sandbox the skill, increasing the chance of unexpected filesystem changes or execution of platform commands.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The documented behavior understates important capabilities: the skill fetches untrusted remote resources, can generate and run VBScript to alter file attributes, and supports WSL-to-Windows command bridging despite being described as merely a Windows folder icon utility. This mismatch is risky because operators may approve it for harmless local customization without realizing it performs network retrieval and command/script execution, which expands the attack surface and trust boundary.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill downloads SVG content at runtime from GitHub Raw via curl, but the manifest describes local icon generation/application and does not disclose network access. This creates a supply-chain and integrity risk: remote content can change, be unavailable, or be tampered with, causing unreviewed data to influence generated icons and execution flow.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The script launches multiple external programs including npm, curl, wslpath, attrib.exe, and PowerShell. While some are functionally related to icon handling on Windows, invoking shell commands increases attack surface through PATH hijacking, unexpected binary behavior, environment manipulation, and hidden side effects not clearly disclosed by the skill description.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
Although the skill is presented as a local Windows folder-icon tool, it silently fetches SVG assets from an external CDN by default. This creates an unnecessary supply-chain and privacy risk: remote content can change unexpectedly, requests reveal usage metadata, and malicious or malformed SVGs may trigger vulnerabilities in downstream parsers/renderers.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill is presented as a local Windows folder-icon utility, but it silently retrieves SVG content from a remote GitHub URL at runtime. This creates a supply-chain and privacy risk: remote content can change unexpectedly, network use may surprise users, and icon generation depends on unpinned external data.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The code writes a temporary VBScript and executes it through cscript.exe to modify filesystem attributes, which expands the skill's execution surface beyond simple icon generation. Because the script content is built from folder paths and then executed by an interpreter, this introduces unnecessary code-execution machinery and increases risk if path contents are unusual or attacker-controlled.

Unvalidated Output Injection

High
Category
Output Handling
Content
with open(vbs_path, "w") as f:
        f.write(vbs)

    subprocess.run(
        ["/mnt/c/Windows/System32/cscript.exe", "/nologo", "D:\\_set_attrs.vbs"],
        capture_output=True, text=True, encoding="gbk", errors="replace"
    )
Confidence
78% confidence
Finding
The dangerous part is not shell injection into subprocess.run, but that the program generates executable VBScript source using filesystem paths and then runs it. If a folder path contains characters that break out of VBScript string literals, an attacker controlling directory names could inject additional VBScript statements and achieve code execution under the user's context.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/folder-icon.js:27