ClawHub
Back to skill

Security audit

Clashx Node Switcher

Security checks across malware telemetry and agentic risk

Overview

This skill coherently automates ClashX menu actions, with the main caution that its screenshot steps can capture sensitive screen content.

Before using it, close or hide sensitive windows, review the exact Peekaboo commands and coordinates for your display, and delete /tmp/clash_nodes.png or /tmp/screen.png after use if created.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs taking a screenshot and saving it to a fixed path in /tmp without warning the user that screen contents may include sensitive information such as messages, credentials, or other app data. Even though the screenshot is used for UI inspection, silent capture and predictable storage increase the risk of unintended data exposure to other local processes or later reuse.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The debugging instructions capture the full screen to a fixed file path without any warning or minimization, which can collect unrelated sensitive content far beyond the ClashX UI. In a desktop automation skill, full-screen capture is particularly risky because it may expose emails, chats, browser sessions, tokens, or other visible secrets.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal