Clawvision Minimal

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:21 AM UTC
• Version: 1.0.13

Overview

The skill is a real session-summary exporter, but it needs Review because its local export flow can fall back to remote chart code and has unsafe rendering/path handling.

Review before installing, especially for sensitive sessions. Use it only on conversations safe to export, avoid untrusted summary JSON or slug values, and prefer a fixed package with no CDN fallback, strict summary schema validation, and output-path containment.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/session_charts.py:22

Finding

Conditional Retrieval and Execution of Unverified CDN JavaScript

Content

View full analysis

{ECHARTS_SRC}" elif ECHARTS_URL: echarts_block = f'' ``` ### Technical Analysis When the bundled `scripts/echarts.min.js` file is unavailable, the analytics generator silently inserts a remote CDN script into the generated document. That script is subsequently loaded by Playwright during PNG rendering or by a user opening the generated analytics HTML. Although the URL contains a fixed version, the downloaded content is not verified using a cryptographic digest or Subresource Integrity. The effective code executed by the Skill can therefore differ from the code reviewed in the package. This behavior also conflicts with the self-contained and no-external-assets requirement stated in `SKILL.md`. The repository currently includes the local ECharts bundle, so the remote branch is not active during an ordinary intact installation. Nevertheless, omission, deletion, packaging error, or local corruption of that file automatically enables the network behavior. ### Attack Path 1. The local `scripts/echarts.min.js` file is omitted from a deployment, removed, or made unavailable. 2. `session_charts.py` sets `ECHARTS_SRC` to `None` and selects the jsDelivr URL. 3. The Skill generates analytics HTML containing a remote `

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_visual.py:371

Finding

HTML Injection Through Unvalidated Summary Fields

Content

View full analysis

{_h(c.get('text', ''))} {_h(status)}\n" template = template.replace('{{checklist}}', checklist) ``` ### Technical Analysis The renderer accepts summary JSON from a file, standard input, or model-generated output. Most textual fields pass through `_h()`, but two paths remain unsafe: 1. `analytics_charts` is inserted directly into the document as raw HTML. 2. `status` is inserted unescaped into a quoted HTML `class` attribute. Only its visible text is escaped. The documented schema expects `status` to be one of `ready`, `pending`, or `blocked`, but the implementation does not enforce that allowlist. A crafted value such as: ```json { "checklist": [ { "text": "Review", "status": "x\" onmouseover=\"alert(document.title)" } ] } ``` breaks out of the `class` attribute and creates an event-handler attribute. Similarly, an attacker-controlled `analytics_charts` field can directly contain elements such as `

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_visual.py:670

Finding

Output Directory Escape Through Unvalidated Slug

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill explicitly states that analytics charts may fall back to a CDN when the local ECharts bundle is absent, which conflicts with its later rule to avoid external assets and not call external APIs with transcript-derived content. Even if the network request is only for a library, loading remote script during rendering expands the trust boundary and can expose session-derived content in the browser context to third-party code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill explicitly states that analytics charts may fall back to a CDN when the local ECharts bundle is absent, which conflicts with its later rule to avoid external assets and not call external APIs with transcript-derived content. Even if the network request is only for a library, loading remote script during rendering expands the trust boundary and can expose session-derived content in the browser context to third-party code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill explicitly states that analytics charts may fall back to a CDN when the local ECharts bundle is absent, which conflicts with its later rule to avoid external assets and not call external APIs with transcript-derived content. Even if the network request is only for a library, loading remote script during rendering expands the trust boundary and can expose session-derived content in the browser context to third-party code.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

- Removed bundled `echarts.min.js` so ClawHub security scan passes; session analytics charts fall back to CDN when the local bundle is absent.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

- Removed bundled `echarts.min.js` so ClawHub security scan passes; session analytics charts fall back to CDN when the local bundle is absent.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 89% confidence

Finding

The skill sends the full transcript to a local model with a prompt template that directly embeds raw conversation content. Because session text is untrusted, a malicious user message inside the transcript can act as an injected instruction to the summarizer, causing prompt injection, sensitive-data regurgitation, or unsafe/incorrect outputs that then get persisted to HTML/Markdown/PPTX exports.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

{{transcript}}

text

## Output rules

- HTML must be self-contained: inline CSS and JS, no external assets. Preset font should be requested from a web-safe fallback stack.
- Include an EN/RU/ZH language switcher and light/dark theme toggle.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

If the bundled ECharts file is absent, the generated HTML loads JavaScript from a public CDN. That creates unneeded external network access and introduces a supply-chain/trust boundary: rendering local session-derived reports can execute remotely hosted script, which may leak metadata, change behavior unexpectedly, or expose sensitive session content to third parties if the page is opened or rendered in a network-enabled browser.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/test_summary.json (reported line 28)May include surrounding context.

json

{"text": "Backup rotation configured", "status": "ready"},
    {"text": "ClawVision charts MVP", "status": "pending"}
  ],
  "next_steps": ["Test ClawVision with real session", "Update SKILL.md workflow", "Add analytics tab to PPTX"]
}

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Summary Design Specification restricts the session language to [en | ru | zh], which imposes a locale limitation in natural-language instructions. The file does not present this as an optional user choice among all languages, nor does it justify the restriction as region-specific or compliance-driven.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language content throughout the session is exclusively in Russian, including user instructions and assistant responses, with no indication that language selection was user-configurable or that the skill is intentionally region-specific. This can violate language/locale policy when a skill implicitly constrains interaction to a single language without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Spawning a headless Chromium instance to load generated HTML and capture screenshots is a substantial rendering capability. For a skill described only as permission disclosure for security audit, browser automation and screenshot generation are not obviously required by the stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description frames the skill around permission disclosure for security auditing, while this file's implemented behavior is session analytics generation: computing message metrics, producing HTML dashboards, and rendering a PNG output. That is a materially different functional scope than permission disclosure, not just an implementation detail of a security audit.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The roadmap states that ClawVision 1.0.7 is the 'current stable version' and that session analytics are only planned for 2.0, but earlier lines document the skill as 1.0.12 and describe session analytics as already implemented since 1.0.9. This is an active contradiction in the skill's own documentation about what the skill currently does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code reads a session JSON file, extracts message data, generates analytics, and embeds the resulting chart and summary into exported outputs. Although the feature is optional, there is no confirmation prompt, visible user-facing notice, or explicit warning in this file that session contents may be analyzed and included in generated artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON transcript contains only Russian prompts and responses, including operational instructions and status messages. Because SQP-3 applies to all file types and covers language/locale policy violations, this can indicate a skill behavior that defaults to a specific language without documenting user choice or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/echarts.min.js:45