ClawHub
Back to skill

Security audit

节假日出行决策skill

Security checks across malware telemetry and agentic risk

Overview

This is a coherent holiday travel planning skill with a static report widget; the main risk is a third-party chart script in the widget, not hidden or destructive behavior.

Install this if you want a Chinese-language holiday travel decision report skill. Be aware that using the visual widget may load Chart.js from jsDelivr; stricter environments should prefer a locally bundled chart library, SRI, and sandboxed widget rendering. Do not treat its travel costs or holiday advice as live booking data unless separately verified.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The widget loads executable JavaScript from a third-party CDN at runtime, which creates a supply-chain and integrity risk: if the CDN, dependency, or network path is compromised, arbitrary script can run in the skill's rendering context. In this skill, the library is not strictly necessary to render a travel report, so the external dependency increases attack surface without being core to the business function.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.