ClawHub
Back to skill

Security audit

智能测试报告

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent test-report generator with expected local parsing and report-export behavior, though users should note the HTML template uses a remote Chart.js CDN.

Before installing, be aware that HTML reports may load Chart.js from a CDN when opened, and exported reports can contain details from test logs such as failure messages. Choose output paths deliberately and avoid including sensitive logs in reports you plan to share.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The HTML report template loads Chart.js from an external CDN, which introduces an unnecessary network dependency into a skill whose stated purpose is local test-result analysis and report generation. This can leak access metadata, break in offline or restricted environments, and creates supply-chain risk if the third-party resource is unavailable or compromised.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The skill description includes broad trigger phrases such as generic references to reports, statistics, analysis, dashboards, and pass rates, which can cause the skill to activate in situations beyond the user's intent. Overbroad activation increases the chance of unintended file parsing, report generation, or output-writing behaviors being invoked on unrelated user requests.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill advertises exporting HTML, PDF, and Excel reports, which implies writing files to user-accessible locations, but it does not disclose this side effect or require confirmation. Hidden write behavior can surprise users, overwrite files, or create artifacts containing sensitive test data without the user's informed approval.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.