ClawHub
Back to skill

Security audit

Python数据分析

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local Python data-analysis assistant; its code execution and optional URL/API data loading are expected for that purpose, with no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable letting the agent run locally generated Python against data you provide. Review requests involving sensitive files, internal URLs, or authenticated API links, and avoid giving secrets unless the analysis genuinely requires them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly promises to generate and execute Python analysis code, but it does not provide an upfront warning that arbitrary generated code will run in the local environment. In an LLM-driven workflow, generated code can unexpectedly read local files, invoke subprocesses, or perform unsafe operations, so lack of explicit user consent and execution constraints creates real code-execution risk.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill allows data ingestion from an API or URL without clearly warning the user that the agent may make outbound network requests. This can leak sensitive query parameters, internal URLs, tokens, or metadata and may also enable access to untrusted remote content that influences subsequent code generation and execution.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.