ClawHub
Back to skill

Security audit

数黑棋子

Security checks across malware telemetry and agentic risk

Overview

This skill locally analyzes Go board photos and has only minor dependency hygiene concerns.

Reasonable to install if you need local Go board-photo counting. Use it only on images you intend to process, verify the generated overlay/result before trusting scoring, and pin or lock dependencies in controlled environments if reproducible installs matter.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.26
opencv-python-headless>=4.8
pillow>=10
Confidence
95% confidence
Finding
The dependency is specified with a lower bound only, which allows future unreviewed versions to be installed. This weakens build reproducibility and can accidentally pull in a compromised or breaking release through the package supply chain.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.26
opencv-python-headless>=4.8
pillow>=10
Confidence
95% confidence
Finding
Using an unpinned version range for opencv-python-headless permits installation of arbitrary newer releases, reducing reproducibility and increasing supply-chain risk. In an image-processing skill, this dependency is central to handling untrusted user images, so unexpected version changes can affect security posture.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy>=1.26
opencv-python-headless>=4.8
pillow>=10
Confidence
95% confidence
Finding
The package specifier allows any Pillow version at or above 10, so environments may resolve to different releases over time. This creates supply-chain and reproducibility risk, especially for a skill that processes attacker-controlled image files.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.