ClawHub
Back to skill

Security audit

Data Analyzer

Security checks across malware telemetry and agentic risk

Overview

This is a small sales reporting skill with limited local file output and no evidence of credential access, persistence, destructive behavior, or exfiltration.

Install only if you are comfortable with a simple, lightly packaged data-analysis skill. Treat the PDF chart path as user-controlled: pass only charts created for this report, not private local images. For stronger operational safety, the publisher should pin dependencies and remove or rename the stray HTML file labeled as a .sh installer.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The PDF function accepts an arbitrary local chart_path and, if the path exists, embeds that file into the generated report. In a skill context, this can expose unintended local files to downstream outputs or enable unauthorized inclusion of sensitive local images, especially if an agent can be induced to pass attacker-chosen paths. The danger is increased because this behavior is not constrained to skill-owned artifacts.

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas
matplotlib
fpdf2
Confidence
97% confidence
Finding
pandas

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas
matplotlib
fpdf2
Confidence
97% confidence
Finding
matplotlib

Unpinned Dependencies

Low
Category
Supply Chain
Content
pandas
matplotlib
fpdf2
Confidence
97% confidence
Finding
fpdf2

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.