ClawHub
Back to skill

Security audit

Design To Html

Security checks across malware telemetry and agentic risk

Overview

This design-to-HTML skill is mostly coherent, but one bundled Python helper can silently install an unpinned package at runtime.

Install only if you are comfortable reviewing and controlling its runtime environment. Prefer the documented Node workflow, install dependencies explicitly, avoid running scripts/pipeline.py unless you accept its automatic Pillow installation behavior, and run it in a sandbox when processing proprietary design images or untrusted HTML.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
except ImportError:
    print("Installing Pillow...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow"])
    from PIL import Image
    import io
Confidence
95% confidence
Finding
subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow"])

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
Installing dependencies during normal script execution is not necessary for the stated image-analysis purpose and introduces a software supply chain risk. The skill context makes this more concerning because an agent or automation may run the script non-interactively, causing unexpected network access and package execution without prior review.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script performs package installation automatically and without any user prompt, warning, or opt-in flag, so execution of the pipeline can trigger a subprocess and external code installation unexpectedly. In agent-driven contexts, this is particularly risky because the behavior may be invisible to the operator and violate least surprise, change-control, or egress policies.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script renders arbitrary HTML with Puppeteer using `page.setContent(..., { waitUntil: 'networkidle0' })`, which allows embedded resources such as images, scripts, stylesheets, iframes, and fetch/XHR requests to be loaded automatically. If the HTML input is attacker-controlled or untrusted, rendering can trigger unintended outbound network access, enabling SSRF-style access to internal services, data exfiltration via remote requests, or privacy leaks about the execution environment.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.