ClawHub
Back to skill

Security audit

prompt-eval

Security checks across malware telemetry and agentic risk

Overview

This prompt-evaluation skill is mostly purpose-aligned, but its bundled viewer opens a localhost server with an unauthenticated feedback endpoint that can write to disk.

Install only if you are comfortable with prompt inputs, model outputs, scores, and reports being saved locally. Prefer static viewer export when possible, stop the localhost server when finished, do not set --feedback-path outside the project directory, and redact secrets or proprietary data before evaluation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'feedback_path' from os.environ.get (line 784, credential/environment) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Content
feedback_path = Path(os.environ.get("FEEDBACK_PATH", "/tmp/feedback.json"))
                try:
                    data = json.loads(body)
                    feedback_path.write_text(json.dumps(data, indent=2, ensure_ascii=False), encoding="utf-8")
                    self.send_response(200)
                    self.send_header("Content-Type", "application/json")
                    self.end_headers()
Confidence
94% confidence
Finding
The POST /api/feedback handler writes attacker-controlled JSON to a filesystem path derived from the FEEDBACK_PATH environment variable, with no authentication, CSRF protection, or path restriction. In the skill context this viewer is a local analysis utility, so exposing an unnecessary write primitive increases risk of local file clobbering or abuse if a browser page or local user can reach the endpoint while the server is running.

Lp3

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding
The skill instructions clearly require reading references and writing multiple artifacts, but the skill declares no permissions. That mismatch can cause hidden capability use outside the declared security model, reducing auditability and increasing the chance that file or environment access occurs without user awareness. In this context, the risk is operational transparency and unintended data exposure rather than immediate code execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
A skill described as prompt evaluation apparently also runs a local HTTP server, opens a browser, serves HTML, loads prior runs, and accepts POST feedback that is written to a file path. That is a significant behavior expansion beyond the declared purpose and introduces attack surface for local web abuse, unsafe file writes, and exposure of prior evaluation artifacts, especially because the skill processes untrusted prompt content and generated outputs. The mismatch is more dangerous here because the skill explicitly handles adversarial data and stores many artifacts, making viewer/server components a sensitive boundary.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The viewer includes a POST endpoint that accepts arbitrary request bodies and persists them to disk, which is beyond the minimal need of rendering evaluation artifacts. Even though the server binds to 127.0.0.1, localhost-only services are still reachable by local processes and sometimes by malicious web pages via browser requests, making this an unnecessary capability expansion for a prompt-evaluation viewer.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The handler silently persists submitted feedback to disk without any confirmation, authentication, or visible warning at the write site. In a local viewer tool, this is more dangerous than necessary because users may not expect network-triggered state changes, and silent writes can be abused to overwrite expected feedback files or plant misleading data in evaluation artifacts.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.