ClawHub
Back to skill

Security audit

MD Formatter

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Markdown formatter that edits only user-specified Markdown files and does not show hidden, network, credential, persistence, or destructive behavior.

Before installing, understand that this skill can overwrite the Markdown file you point it at. Use it on files you intend to modify and review the resulting diff, especially for important documentation, because formatting rules may change text layout or emphasis.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs the agent to read and overwrite arbitrary markdown files and references a formatter script, but it does not declare any permissions despite clearly requiring file read and file write capabilities. This creates a permission-model gap: an agent or platform relying on declared permissions may grant or review the skill as lower risk than it actually is, increasing the chance of unintended file access or modification.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.