ClawHub
Back to skill

Security audit

offline-quiz-builder

Security checks across malware telemetry and agentic risk

Overview

Review recommended: the skill is mostly coherent and local-only, but its browser-opening helper can pass a user-influenced file path through shell commands.

Before installing, check whether you are comfortable with a skill that reads study files, writes a local website, stores progress in browser localStorage, and can create an optional daily reminder. Avoid using generated site paths containing quotes or unusual shell characters, and consider skipping reminders until open_quiz.py is changed to use subprocess arguments without a shell.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
if sys.platform.startswith("win"):
            os.startfile(str(index))  # noqa: S606
        elif sys.platform == "darwin":
            os.system(f'open "{index}"')
        else:
            os.system(f'xdg-open "{index}"')
Confidence
89% confidence
Finding
os.system(f'open "{index}"')

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
elif sys.platform == "darwin":
            os.system(f'open "{index}"')
        else:
            os.system(f'xdg-open "{index}"')

    print(f"已在默认浏览器打开：{url}")
    return 0
Confidence
89% confidence
Finding
os.system(f'xdg-open "{index}"')

Tp4

High
Category
MCP Tool Poisoning
Confidence
80% confidence
Finding
The skill description promises broad ingestion of PDFs, Word, Excel, notes, and automatic question generation plus reminder creation, but the implementation appears unable to perform several of those claims directly. This is dangerous because users may trust the skill with sensitive study materials or operational expectations that are not actually supported, leading to unsafe workarounds, unexpected data handling, or incorrect reliance on automation that never gets created.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger phrase at line 17 is broad enough to match generic study-related requests that may not explicitly ask for this specific skill, which can cause unintended auto-invocation. In this skill's context, that matters because the skill has read-write local filesystem access and Bash tool access, so accidental routing can expose local content to unnecessary processing or trigger local file modifications.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.