ClawHub
Back to skill

Security audit

Convert OVOBJ to SHP

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed file converter for OVOBJ/OVKML point data and does not show hidden, persistent, networked, or credential-handling behavior.

Install this if you intend to convert OVOBJ or OVKML point files locally. Be aware it reads the input path you provide, can scan a directory for supported files when requested, and writes Shapefile sidecars plus a JSON report; only use --recursive or --overwrite when you intend that broader processing or replacement.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to read user-supplied OVOBJ/OVKML files and write converted Shapefile outputs, but it declares no permissions. That mismatch is a real security issue because permissionless-looking skills can bypass user and platform expectations about filesystem access, increasing the chance of unintended reads, writes, overwrites, or processing of sensitive local data.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.