ClawHub

Pixel Asset Pipeline

Security checks across malware telemetry and agentic risk

Overview

This skill is a local pixel-art asset pipeline whose file access and script execution are visible and aligned with generating Godot-ready sprites.

Install only if you are comfortable running local Python image-processing scripts. Use trusted JSON configs and only pass --generator or --processor paths to scripts you already trust; choose output directories deliberately.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation instructs users to run local Python scripts and invoke generation/processing commands, which implies shell execution and file access capabilities, but the metadata declares only a binary requirement and no explicit permissions. This mismatch can cause users or platforms to grant more capability than is transparently disclosed, increasing the risk of unintended file access or command execution in environments that rely on declared permissions for trust and isolation.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script allows the caller to supply arbitrary paths for --generator and --processor, then executes them with Python. That expands the skill from asset processing into a generic local code launcher, which is dangerous if the skill is run by an agent, CI job, or another system that passes untrusted or loosely controlled arguments.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal