ClawHub
Back to skill

Security audit

Widgets Ui

Security checks across malware telemetry and agentic risk

Overview

This skill is a documentation-only helper for adding and using React/Next.js JSON UI widgets, with no hidden local access or persistence found.

Before installing, review the remote shadcn registry content because the documented npx command adds externally hosted code to your project. When rendering agent-generated widget JSON, validate allowed actions, image URLs, and form handling in your application.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list is unusually broad for a UI-rendering skill, including generic phrases like 'widgets', 'dynamic ui', and 'structured output ui' that could match many unrelated requests. This can cause the skill to activate outside its intended scope, increasing the chance that an agent routes arbitrary user content into a component that renders agent-supplied JSON UI, which expands attack surface and can enable unsafe or confusing interactions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal