ClawHub
Back to skill

Security audit

Power Cad Drafter

Security checks across malware telemetry and agentic risk

Overview

This is a purpose-aligned electrical CAD drafting and audit helper that writes expected project files, with output-path and trigger-scoping cautions but no evidence of malicious behavior.

Use this only in a workspace where creating CAD and audit files is intended. Provide explicit input and output paths, check for existing files before running the scripts, and treat the generated drawings and audit report as draft engineering assistance rather than final professional approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs installation of Python packages and references scripts that read from and write to the workspace, but it declares no permissions or user-facing constraints for those capabilities. This can lead to unexpected filesystem access, overwriting files, or packaging sensitive project data without clear authorization boundaries.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger conditions are broad enough to match common engineering and drawing-related requests, so the skill may activate in situations where the user did not intend CAD generation or automated auditing. Over-broad activation increases the chance of unnecessary file generation, unintended use of local reference files, and unsafe reliance on inferred design outputs in the wrong context.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The deliverables include a ZIP package containing drawings, inferred design parameters, audit results, and equipment lists, but the skill does not clearly warn users that these artifacts will be created and bundled. In an engineering environment, those outputs may contain sensitive project metadata or derived internal standards information, so lack of notice creates data handling and user-consent risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script writes the generated audit report to a filesystem path, and by default uses a hard-coded absolute path under a user home directory without any confirmation or safety checks. In an agent/skill context, silent file writes can cause unintended persistence, overwrite existing files, or leak sensitive design/audit data to locations the user did not explicitly approve.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.