ClawHub
Back to skill

Security audit

round-robin-allocator

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed allocation and reporting tool, with the main caution that generated HTML reports load chart libraries from a public CDN.

Before installing, be comfortable with local report files being created and with generated HTML fetching Chart.js and Plotly from jsdelivr when opened. Use --no-html or --no-open for more controlled/offline use, and avoid --always unless you intentionally want future runs to skip the confirmation table.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill declares low sensitivity and no notable permissions, yet the documented behavior and file structure indicate local file read/write capability via configuration persistence and report generation. This mismatch can cause the host or user to grant the skill more trust than warranted, increasing the chance of unintended filesystem access or silent artifact creation.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The declared purpose presents the skill as a simple allocation utility, but the described behavior expands into interactive input parsing, local persistence, file generation, browser launching, and loading third-party CDN resources. This is dangerous because users and orchestration systems may invoke the skill under a much narrower trust assumption, while the actual behavior can write files and trigger external network-dependent content.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This static HTML page executes third-party JavaScript from public CDNs (Chart.js and Plotly) at page load, which gives remote code the same privileges as local page scripts. For a claimed 'pure static HTML' result viewer, this creates unnecessary supply-chain and privacy risk: CDN compromise, dependency hijack, or unexpected network access can execute attacker-controlled code in the user's browser.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The generated report is not actually self-contained because it loads Chart.js and Plotly from external CDNs at view time. This creates a supply-chain and privacy boundary issue: opening the local HTML causes network requests to third parties, and if a CDN asset is compromised or blocked, the visualization may execute untrusted code or fail unexpectedly.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The skill advertises CSV and HTML output, and elsewhere indicates CDN-backed visualization, without clearly warning users that files may be created locally and that viewing the HTML may fetch remote resources. This can lead to unexpected artifact creation and metadata leakage such as IP address or environment-dependent browsing behavior when external scripts are loaded.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The HTML silently loads remote JavaScript from third-party CDNs without warning the user that opening the file will trigger outbound network requests. In this skill context, the visualizer may process potentially sensitive allocation data, so even metadata about access patterns or environment egress can be unexpectedly disclosed, and users may assume the file is safe to open offline.

Hidden Instructions

High
Category
Prompt Injection
Content
对象ID,轮次1,轮次2,轮次3,轮次4,覆盖率
1,3,2,1,5,80.0%
2,3,1,2,5,80.0%
3,2,3,1,4,80.0%
Confidence
60% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
### 配置系统（代码强制钩子）
- 新增 `_allocator_config.json` 持久化配置：`skip_confirm`（跳过确认）、`default_mode`（默认后处理模式）
- 支持 CLI 选项：`--no-confirm`（本次跳过）、`--always`（永久跳过并写配置）、`--set-default-mode`（设默认模式）
- 配置由脚本在标准化数据目录读取，LLM 无法绕过

### 确认表与交互菜单（全量重构）
Confidence
22% confidence
Finding
--no-confirm

Tool Parameter Abuse

High
Category
Tool Misuse
Content
parser.add_argument("--no-html", action="store_true", help="不生成 HTML")
    parser.add_argument("--no-open", action="store_true", help="生成后不自动打开浏览器")
    # 配置相关
    parser.add_argument("--no-confirm", action="store_true", help="跳过本次确认（不影响配置文件）")
    parser.add_argument("--always", action="store_true", help="跳过确认并保存到配置（永久生效）")
    parser.add_argument("--set-default-mode", choices=["algorithm","random","fair","custom"],
                        help="设置默认后处理模式并保存到配置", default=None)
Confidence
85% confidence
Finding
--no-confirm

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.