ClawHub
Back to skill

Security audit

go-next-move

Security checks across malware telemetry and agentic risk

Overview

This skill coherently provides local Go board analysis using KataGo, with disclosed local file and image outputs but no evidence of hidden network, credential, or destructive behavior.

Install this only if you are comfortable running local Python/OpenCV code and KataGo on board images you provide. Be aware that annotated board images may be written to the system temp directory, and correction retries may copy the original image plus metadata into a local recognition-label folder.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares no permissions, yet its instructions explicitly require shell execution, local file reads/writes, environment-controlled paths, and launching a local `katago` subprocess. This mismatch can bypass user or platform expectations about what the skill is allowed to do, increasing the risk of unintended file access or command execution if the host relies on declared permissions for policy enforcement.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
When image input is used and no source_result_image is provided, the code automatically writes an analysis image to a generated file in the system temporary directory. This creates potentially sensitive user-derived artifacts on disk without explicit opt-in, which can leak board photos or analysis results to other local users, backups, or later processes depending on host configuration.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.