ClawHub

汽配配件 EPC(电子目录）分解图查询

Security checks across malware telemetry and agentic risk

Overview

This skill performs the disclosed VIN-and-parts EPC lookup through a named external service and shows no hidden, destructive, or persistent behavior.

Install only if you trust the EPC provider with VIN and parts-query data. Use a dedicated JZ_API_KEY where possible, avoid submitting VINs you are not authorized to share, and run it in an environment where the Python requests dependency is trusted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill declares runtime requirements for an environment variable API key and documents a backend HTTPS API endpoint, but it does not declare explicit permissions corresponding to those capabilities. This creates a trust and containment gap: an agent or platform may execute code with network access and secret access that are not transparently represented in the skill's permission model, increasing the risk of unintended data exfiltration or misuse if the referenced script behaves unexpectedly.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill transmits a 17-character VIN and parts query data to a third-party remote service without any in-code disclosure, consent flow, or minimization. A VIN can be sensitive business or customer data, and sending it externally may create privacy, compliance, and data-handling risks if users are unaware of the transfer.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal