ClawHub
Back to skill

Security audit

mac-node-snapshot

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Mac screenshot helper, but users should be aware it captures whatever is visible on screen and leaves temporary capture files locally.

Install only if you want an agent to capture your Mac screen on request. Hide sensitive windows before use, grant Screen Recording permission intentionally, and remember that the temporary MP4 and PNG may remain in the skill's tmp folder until removed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases are broad enough to match ordinary user requests like 'Take a screenshot' or 'What is on my screen?', which can cause the skill to activate in situations where the user did not specifically consent to this capture method. Because the skill records the current screen and saves artifacts to disk, unintended invocation can expose sensitive on-screen information and create privacy-impacting local files.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explains how to capture the screen and save both an MP4 and PNG under the skill directory, but it does not prominently warn that it captures whatever is currently visible and persists those artifacts on disk. This omission increases the risk of collecting sensitive content without informed consent and leaving recoverable files behind after the task completes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.