ClawHub
Back to skill

Security audit

SWF Game Port Decompiler

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SWF decompilation helper that reads a user-selected SWF and writes extracted files to a separate output folder.

Install only if you intend to run FFDec locally on SWF files you own or are authorized to analyze. Use a dedicated output folder, expect large extracted files, and treat untrusted SWFs as potentially risky inputs to external tooling even though this skill advises extraction rather than Flash execution.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to use Python and FFDec CLI to read SWF files, write extracted output, inspect environment/PATH, and execute shell commands, but the skill declares no permissions. This creates a real least-privilege and transparency issue because an agent could perform filesystem and command execution actions the user or platform did not explicitly authorize, especially when processing untrusted SWF inputs and writing large decompile outputs.

Static analysis

No suspicious patterns detected.