ClawHub

An AI-powered tool that turns conversations into polished, structured summary cards by extracting key ideas, action items, and next steps.

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Mew.Design-powered chat-to-image generator, with sensitive API-key and conversation-summary handling that users should understand before use.

Install only if you are comfortable giving your agent a Mew.Design API key and sending summarized conversation content to Mew.Design. Use a dedicated revocable key if possible, avoid using it for confidential chats unless the provider's data handling is acceptable, and remember that a temporary request JSON file may contain the summary text.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill invokes shell commands, writes temporary files, and performs outbound network requests, yet declares no permissions or equivalent capability disclosure. This creates a transparency and consent gap: an agent or user may authorize the skill expecting harmless summarization while it actually handles credentials and sends data to third-party services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The description frames the skill as installation help and image summarization, but the implementation also collects and validates third-party API keys and performs authentication probing against an external service. That mismatch can mislead users into exposing secrets and conversation content under incomplete or inaccurate expectations, increasing the risk of unauthorized data disclosure.

External Transmission

Medium
Category
Data Exfiltration
Content
Then generate the image through the official Mew design API:

```bash
curl -sS -X POST "https://api.mew.design/open/api/design/generate" \
  -H "Content-Type: application/json" \
  -H "x-api-key: USER_PROVIDED_KEY" \
  --data @/tmp/chat-summary-body.json
Confidence
95% confidence
Finding
curl -sS -X POST "https://api.mew.design/open/api/design/generate" \ -H "Content-Type: application/json" \ -H "x-api-key: USER_PROVIDED_KEY" \ --data

External Transmission

Medium
Category
Data Exfiltration
Content
Then generate the image through the official Mew design API:

```bash
curl -sS -X POST "https://api.mew.design/open/api/design/generate" \
  -H "Content-Type: application/json" \
  -H "x-api-key: USER_PROVIDED_KEY" \
  --data @/tmp/chat-summary-body.json
Confidence
95% confidence
Finding
https://api.mew.design/

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal