ClawHub
Back to skill

Security audit

Plantuml

Security checks across malware telemetry and agentic risk

Overview

This PlantUML skill is purpose-matched and local-first, but its optional remote rendering mode can upload diagram text if explicitly enabled.

Install if you are comfortable using local Docker or Java-based PlantUML rendering. Do not enable --use-public-server for confidential architecture, credentials, customer data, or proprietary designs; prefer Docker or a trusted local JAR, and verify PLANTUML_PUBLIC_SERVER before using any remote backend.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
try:
        shutil.copy2(src, tmpdir / src.name)
        try:
            r = subprocess.run(
                ["java", "-jar", str(jar), f"-t{ext}", "-o", str(tmpdir), str(tmpdir / src.name)],
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,
Confidence
71% confidence
Finding
The code invokes a local plantuml.jar on attacker-controlled diagram input. While the subprocess API usage avoids shell injection, rendering untrusted PlantUML in a local Java process expands the attack surface to parser bugs, include behavior, or renderer vulnerabilities in the local runtime.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
]
                log("  → CJK mode: mounting host fonts and refreshing font cache")
                try:
                    r = subprocess.run(cmd, env=env, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
                    if r.returncode == 0:
                        gen = _iter_output_candidate(tmpdir, (ext, fmt), src.name)
                        if gen:
Confidence
78% confidence
Finding
This Docker invocation runs a shell inside the container with 'sh -c' to refresh fonts and render the diagram. The command string embeds src.name; although the generated temporary filenames are controlled by the program, using a shell increases risk and the container still processes untrusted PlantUML input that could exploit PlantUML or Java inside the container.

Tainted flow: 'req' from os.environ.get (line 730, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
            headers={"Content-Type": "text/plain"},
        )
        with urllib.request.urlopen(req, timeout=60) as resp:
            payload = resp.read()
        output_file.write_bytes(payload)
    except (urllib.error.URLError, OSError, TimeoutError):
Confidence
91% confidence
Finding
When --use-public-server is enabled, the script sends the full diagram source to a remote server, and the destination can be overridden via the PLANTUML_PUBLIC_SERVER environment variable. That creates a real exfiltration path for potentially sensitive architecture or business data, especially in an agent setting where environment configuration may be influenced externally.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no permissions, yet its documented workflow clearly involves shell execution, file reads/writes, optional network access, and environment-variable use. This creates a trust-boundary mismatch: users or policy engines may approve the skill under the assumption it is low-privilege when it can actually execute commands and exfiltrate diagram contents if remote rendering is enabled.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The public description understates behavior by presenting the skill as a local diagram generator while the documentation also allows third-party upload, source rewriting, and additional output modes. That mismatch can mislead users into supplying sensitive architecture or code snippets under incorrect assumptions about data handling and transformation.

Intent-Code Divergence

Low
Confidence
89% confidence
Finding
The file claims it reads no environment variables, but later documents PLANTUML_PUBLIC_SERVER as an input controlling the remote destination. Inconsistent disclosure of configuration sources weakens auditability and can hide network-routing behavior from reviewers and policy systems.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.