ClawHub
Back to skill

Security audit

测试用例生成器

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent test-case generator with optional CSV/Excel export, with only a mild local file-writing caution.

Installers should treat this as a normal test-case generation skill. When requesting CSV or Excel output, ask the agent to confirm the destination filename first, especially if testcases.csv or testcases.xlsx already exists in the workspace.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs generating and executing Python code to create CSV and Excel files, which introduces unnecessary code-execution behavior for a content-generation skill. Even though the sample code is simple, allowing execution and file creation expands the attack surface and can be abused or unexpectedly modified in downstream contexts.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill tells the agent to write local files such as 'testcases.csv' and 'testcases.xlsx' without warning the user that this modifies the filesystem. Silent local file creation violates the principle of explicit consent for side effects and could surprise users or be chained with other instructions to overwrite or plant files.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.