ClawHub
Back to skill

Security audit

Dwg To Dxf Converter

Security checks across malware telemetry and agentic risk

Overview

This skill is a local DWG-to-DXF converter whose file writes and converter execution match its stated purpose, with ordinary caution needed around the local converter binary and chosen paths.

Install only if you need local DWG-to-DXF conversion on Windows. Confirm the input file or folder and output directory before running, and verify that ODAFileConverter.exe comes from a trusted ODA installation or bundled path rather than an unexpected PATH location.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill invokes a local Python script and a bundled converter capable of shell execution and writing files, yet it declares no permissions or safeguards. In an agent environment, undeclared file-write and shell capabilities reduce transparency and policy enforcement, increasing the chance of unsafe execution on attacker-controlled file paths or unintended filesystem locations.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The activation rule is overly broad and requires immediate invocation whenever certain phrases or any .dwg file appears in a workflow. This can cause the agent to trigger the skill without adequate intent verification, context checks, or trust assessment of supplied files, expanding the attack surface for malicious or accidental file processing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.