ClawHub
Back to skill

Security audit

DumplingAI

Security checks across malware telemetry and agentic risk

Overview

This DumplingAI skill is broadly purpose-aligned, but it exposes a generic execution action while presenting itself as mostly safe read/search tooling.

Review this skill before installing. It is not clearly malicious, but users should treat `run` as potentially state-changing or credit-consuming and require explicit confirmation plus schema review before using it, especially for managed provider endpoints.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest and description frame the skill as suitable for 'searching and reading data,' but the documented `run` action is a generic execution surface that can invoke DumplingAI capabilities or provider endpoints with arbitrary JSON input. That mismatch can cause an agent or user to treat the skill as read-only and invoke it in contexts where state-changing or otherwise risky operations are possible.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The safety section asserts that untagged actions are reads and safe to run directly, yet `run` is untagged despite being a generic execution primitive whose effects depend on the target capability or endpoint. This creates a strong risk of unsafe automatic execution, because an agent may skip confirmation for an operation that can trigger non-read side effects or costly external actions.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase 'Use this skill for ANY DumplingAI request' is overly broad and encourages invocation for all DumplingAI-related tasks without considering least privilege or whether the task is actually read-only. In combination with the generic `run` action, this increases the chance that the skill is selected in inappropriate contexts and granted unnecessary operational reach.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.