ClawHub
Back to skill

Security audit

Data Visualization

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent data-visualization helper, but it directs users toward mutable remote installers and external execution services without enough scoping or disclosure.

Review this before installing. Prefer manual, version-pinned installation of the inference.sh CLI, inspect installer contents, and avoid sending private datasets, credentials, or proprietary code through infsh app runs unless you trust that service and understand where login credentials are stored.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Remote Installer Is Downloaded and Executed Without Prior Verification

Content
View full analysis
Remediation
View remediation
" ``` 4. Publish the expected digest through a trusted channel independent of the downloaded artifact, then verify it locally before installation: ```bash echo " infsh" | sha256sum --check - ``` 5. Prefer a cryptographically signed release and verify the signature against a documented, pinned public key. 6. Require users to inspect installation scripts before execution if a script-based installation remains necessary. 7. Document the installer's files, network destinations, credential storage, permissions, and update behavior. 8. Separate installation from authentication so users can validate the installed executable before running `infsh login`. 9. Where possible, provide visualization examples using locally installed, established plotting tools so that the Skill's core guidance does not depend on remote shell execution. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:205
Finding

Related Skills Are Installed from Unpinned Third-Party References

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

curl -fsSL https://cli.inference.sh | sh executes a remotely fetched script directly in the shell, which is a classic high-risk pattern. If the hosting domain, transport path, or upstream release process is compromised, arbitrary code can run immediately on the user's machine; the surrounding install note reduces but does not eliminate this risk because the bootstrap script itself must still be trusted before any verification occurs.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a chart with Python
infsh app run infsh/python-executor --input '{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest uses many broad trigger phrases such as chart, graph, plot, and visualization, which can cause the skill to activate in a wide range of ordinary conversations. In context, that matters because activation may steer users toward external tooling and command execution they did not explicitly request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation tells users to pipe a remote install script into sh and then run external apps, but it does not clearly warn that commands will execute locally and that input data may be transmitted to third-party infrastructure. That omission creates avoidable code-execution and data-exposure risk, especially for users expecting a simple visualization tutorial.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill recommends npx skills add ... without pinning a specific package version or commit, which allows future upstream changes to alter what code is fetched and executed. Because npx can download and run package-provided code at invocation time, a compromised package, tag, or dependency chain could lead to unintended code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This npx skills add invocation is unpinned, so the behavior depends on whatever content is published upstream at execution time. In a security context, that creates supply-chain risk and weakens reproducibility, especially since users are being instructed to run it directly from documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

An unversioned npx reference means the installed skill may change over time without review, and a malicious or compromised upstream release could be delivered to users. Even though this is in a related-skills section, it still normalizes execution of mutable remote content from documentation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This skill is described as data-visualization guidance, but the documentation quickly shifts into installing and using a network-backed CLI and remote execution apps. That mismatch increases the chance that users will run commands and send data externally without realizing the operational and privacy implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.