ClawHub
Back to skill

Security audit

Convert OVOBJ to SHP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed file converter for OVOBJ/OVKML point data and does not show hidden, persistent, networked, or credential-handling behavior.

Install this if you intend to convert OVOBJ or OVKML point files locally. Be aware it reads the input path you provide, can scan a directory for supported files when requested, and writes Shapefile sidecars plus a JSON report; only use --recursive or --overwrite when you intend that broader processing or replacement.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to read user-supplied OVOBJ/OVKML files and write converted Shapefile outputs, but it declares no permissions. That mismatch is a real security issue because permissionless-looking skills can bypass user and platform expectations about filesystem access, increasing the chance of unintended reads, writes, overwrites, or processing of sensitive local data.

Static analysis

No suspicious patterns detected.