ClawHub
Back to skill

Security audit

QuickClass作业转换器

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward QuickClass quiz converter that reads user-provided teaching materials and creates local JSON or Word outputs, with privacy considerations around OCR and vision tools.

Install only if you are comfortable letting the agent process the teaching materials you provide, including images, answer keys, or student-related content. For sensitive or copyrighted materials, confirm where OCR and image-understanding tools run before using the image or scanned-PDF workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill instructs the agent to read source files and write intermediate/output files, but the metadata does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or hosting systems may not realize the skill can access local documents and produce derived artifacts, which increases the risk of unintended data exposure or unauthorized file handling.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The activation conditions are broad enough that the skill could trigger on generic references to learning materials or conversion tasks, causing it to process sensitive educational documents more often than intended. Overbroad routing increases the chance of unnecessary access to local files, OCR of uploaded content, and creation of derived files containing potentially sensitive student or teacher data.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
In visual-recognition mode, the script prints absolute/local image paths and instructs an external image-understanding workflow to inspect extracted images from user-supplied Word/PDF documents. Those images may contain sensitive educational materials, student data, answer keys, or copyrighted content, so exposing them to another tool or log stream without an explicit consent/privacy boundary creates a real confidentiality risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.