ClawHub
Back to skill

Security audit

FaviconDL · 任意网站 Favicon 下载工具

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed favicon downloader whose network access and local file writing fit its stated purpose, with only a supply-chain hygiene caveat around optional GitHub script downloads.

Before installing, understand that favicon requests send the target domain or URL to favicondl.com and may save image files locally. Prefer the packaged script when available, and review any script downloaded from GitHub raw before running it because the documentation does not pin hashes or immutable release assets.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to download PowerShell and Bash scripts directly from raw.githubusercontent.com and make them executable, but it does not prominently warn users to inspect the scripts, pin a specific commit, or verify integrity before execution. This creates a supply-chain risk: if the upstream repository, branch, or delivery path is compromised, users may execute attacker-controlled code on their local machine.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.