ClawHub
Back to skill

Security audit

Card Shared Rules

Security checks across malware telemetry and agentic risk

Overview

This shared card-research skill is mostly scoped, but it includes an under-disclosed PDF helper that can install software and launch an unsandboxed browser if run.

Review this before installing, especially if you use skills in a sensitive or shared environment. The card research rules themselves are reasonably scoped, but avoid running generate-pdf.py unless the dependency installation is made explicit and pinned and the browser invocation is hardened by removing --no-sandbox, avoiding broad remote origins, and using a safer debugging setup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
import websocket

    port = 9223
    proc = subprocess.Popen(
        [
            browser,
            "--headless=new",
Confidence
89% confidence
Finding
proc = subprocess.Popen( [ browser, "--headless=new", "--disable-gpu", "--no-sandbox", f"--remote-debugging-port={port}",

subprocess module call

Medium
Category
Dangerous Code Execution
Content
import websocket  # noqa: F401
    except ImportError:
        print("Installing websocket-client...")
        subprocess.run(
            [sys.executable, "-m", "pip", "install", "websocket-client", "-q"],
            check=True,
        )
Confidence
98% confidence
Finding
subprocess.run( [sys.executable, "-m", "pip", "install", "websocket-client", "-q"], check=True, )

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The code conditionally installs a Python package at runtime even though the script's purpose is PDF generation. Runtime dependency installation introduces a supply-chain and environment-tampering pathway that is unnecessary for the stated function and can execute unreviewed code fetched from external repositories.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The only notice before invoking pip is a brief status message, so users are not meaningfully warned that the script will alter their Python environment and fetch executable code from the network. That lack of informed consent increases the chance of unsafe execution in sensitive environments and masks supply-chain exposure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.