ClawHub
Back to skill

Security audit

hug-html

Security checks across malware telemetry and agentic risk

Overview

The skill is a mostly coherent HTML generator, but it under-discloses third-party QR network requests and permits raw JavaScript in generated templates.

Review carefully before installing if you will generate QR codes, process untrusted template specs, or open generated HTML in sensitive environments. Treat generated files with custom scripts as active web content, avoid putting secrets or internal URLs into QR payloads, and prefer disabling or replacing the remote QR service with local QR generation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented purpose understates several behaviors with security relevance, especially auditing arbitrary HTML files, exporting interfaces for external consumption, and generating QR codes via an external web API despite claims of no external network access. This mismatch can cause operators to grant trust or permissions under false assumptions, increasing the chance of unintended data exposure or processing of untrusted files.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The generator takes a `scripts` field from the template spec and injects it verbatim into the output HTML inside a `<script>` tag. That enables arbitrary JavaScript execution in the rendered page, which is far beyond normal grid/HTML layout composition and can lead to XSS-like behavior, data exfiltration, malicious redirects, or local file abuse when the generated HTML is opened.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The exported interface specification explicitly documents a `scripts` field for custom JavaScript, encouraging downstream agents or users to supply executable payloads. In a skill whose stated purpose is HTML/grid composition, this expands the trust boundary and normalizes arbitrary active content generation, making malicious script insertion an intended feature rather than an accidental edge case.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The post-generation guide claims the audit guarantees rendering safety, but the actual audit only checks whether script blocks are empty and does not inspect, restrict, or block dangerous JavaScript. This creates a false sense of safety that can cause users or calling agents to trust malicious generated HTML that still contains arbitrary executable code.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The QR code component generates an <img> tag whose src points to a third-party QR API, causing generated HTML to make external requests at render time. This contradicts the otherwise local component-assembly behavior and can leak user-supplied QR content to an external service without an obvious trust boundary or consent flow.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
Any viewer opening the generated HTML will trigger a request to the external QR service, creating undeclared network egress from otherwise static output. If QR content contains internal URLs, tokens, identifiers, or sensitive business data, that information is exposed to the third party and may also be logged by intermediaries.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The code transmits component content directly to a remote QR service via a query string, with no user-facing disclosure or consent. Query-string transmission is especially risky because sensitive content can be exposed in browser history, logs, proxies, and the third-party provider's records.

External Transmission

Medium
Category
Data Exfiltration
Content
size = comp.get("size", "120px")
    label = comp.get("label", "")
    # 使用QR码API生成
    qr_url = f"https://api.qrserver.com/v1/create-qr-code/?size={size}x{size}&data={_esc(content)}"
    html = f'<img class="component-qrcode" src="{qr_url}" alt="QR" style="width:{size};height:{size};display:block;">'
    if label:
        html += f'<p class="component-qrlabel" style="text-align:center;font-size:12px;color:#888;margin:4px 0 0 0;">{_esc(label)}</p>'
Confidence
98% confidence
Finding
The hardcoded https://api.qrserver.com endpoint is a direct external transmission sink. In the skill context, this is more dangerous because the tool presents itself as a local HTML/component assembler, so consumers may reasonably assume generated output is self-contained and privacy-preserving when it is not.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.