ClawHub
Back to skill

Security audit

公众号排版器

Security checks across malware telemetry and agentic risk

Overview

This skill is a purpose-aligned WeChat article formatter that creates a local HTML file and does not show hidden network, credential, or destructive behavior.

Install only if you want a local HTML-based WeChat公众号 formatting workflow. Expect it to write generated article HTML into your working directory and include a copy-to-clipboard button; review the generated file before opening, copying, or publishing, especially if the article content came from an untrusted source.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The trigger conditions are broad enough that the skill could activate for generic formatting requests that are not specifically about WeChat公众号 output. Unintended activation can cause the agent to steer users into generating HTML files, applying domain-specific formatting, or using this skill in contexts where a simpler or safer response was intended.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The workflow tells the agent to save an HTML file into the user's working directory without clearly disclosing that a file will be created or obtaining explicit user confirmation at that step. Writing files without a user-facing notice can violate user expectations, create persistence on disk, and increase risk if the generated HTML later contains unsafe or unreviewed user-supplied content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.