ClawHub
Back to skill

Security audit

GLM-V-Grounding

Security checks across malware telemetry and agentic risk

Overview

This is a coherent GLM-V image and video grounding skill that uses a disclosed API key, external API calls, local media reads, and optional visualization outputs for its stated purpose.

Install only if you are comfortable sending the images, videos, and prompts you choose to the Zhipu GLM-V service. Use a dedicated revocable API key, keep the generated .env file out of version control, install dependencies in an isolated environment, and avoid sensitive media unless that external processing is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation indicates capabilities to read environment variables, access local files, write visualization outputs, make network requests to remote URLs/APIs, and invoke shell commands, but it does not declare permissions explicitly. This creates a real security gap because operators and policy engines cannot accurately assess or constrain what the skill can do, increasing the chance of over-privileged execution and unsafe handling of user-supplied files/URLs.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.