ClawHub
Back to skill

Security audit

Jlceda Plugin Builder

Security checks for vulnerabilities and agentic risk

Overview

This EasyEDA development skill is purpose-aligned, but it needs Review because it can run a local bridge, execute code in EasyEDA, and persist login or debug data with limited cleanup guidance.

Install only if you are comfortable letting an agent control a live EasyEDA session through a local bridge. Use a dedicated workspace/account where possible, review any remote repo or npm install before running it, avoid logging secrets, and clear any browser-data or debug logs after use on shared machines.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs project initialization by cloning a remote repository and running package installation/build commands, but it does not require explicit user consent or warn about network access, filesystem changes, and execution of third-party install scripts. In an agent context, this can lead to unintended code retrieval and command execution in the user's workspace, which increases supply-chain and workspace integrity risk even if the author likely intended normal setup guidance.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document explicitly states that login state is persisted in a local browser-data cache to avoid repeated QR-code logins, but it provides no warning about shared-machine use, credential persistence, or how to clear that state. In a plugin-development skill that automates browser interaction with a logged-in EasyEDA account, this increases the risk of unintended account access by other local users or later processes on the same machine.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The `dev_plugin` workflow enables continuous capture of browser console output and page errors, but the documentation does not warn that logs may contain sensitive information such as plugin data, tokens, file paths, project content, or debugging secrets. Because this skill is specifically for extension/plugin development, console output is likely to include application internals and user-generated design data, making silent collection and retention more dangerous.

Static analysis

No suspicious patterns detected.