ClawHub
Back to skill

Security audit

CorelDRAW Editor

Security checks for vulnerabilities and agentic risk

Overview

This CorelDRAW skill does what it says, but users should avoid in-place edits unless they have a backup.

Install only if you are comfortable letting the agent open CorelDRAW and read or write the CDR files you specify. Prefer copy-first edits with explicit output paths, inspect previews before and after, and use --in-place only after making your own backup.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill clearly instructs reading existing `.cdr` files and writing edited copies, previews, manifests, and exports, but it does not declare corresponding permissions. That mismatch can bypass user or platform expectations about filesystem access, increasing the chance of unintended file exposure or overwrite when the skill is invoked.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The tool can persist destructive edits directly to the original CDR when --in-place is used, with no confirmation prompt, backup creation, or dry-run safeguard. In an agent context, a malformed or overly broad plan can delete or alter artwork irreversibly, causing integrity loss of user documents.

Static analysis

No suspicious patterns detected.