ClawHub
Back to skill

Security audit

写材料格式工具

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward document formatter that creates local Word files, with no evidence of hidden data access or exfiltration.

Install only if you are comfortable with the skill creating Word documents on your machine. Review or choose the output path before running it with sensitive drafts, and install `python-docx` only from a trusted package source.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly defines a default output path on the user's Desktop and implies file creation, but it does not prominently warn users that invoking the skill will write a `.docx` file to local storage. In an agent setting, silent filesystem writes can surprise users, create privacy issues, or overwrite expected workspace conventions, especially if the agent acts without an explicit save confirmation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.