ClawHub
Back to skill

Security audit

Multi-Modal Content Creator

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated purpose, but users should understand it handles customer messages, OpenAI requests, local output files, and a locally saved WhatsApp token.

Install only if you are comfortable providing an OpenAI API key and WhatsApp-style token, sending customer text/audio prompts to OpenAI, and storing generated outputs locally. For production use, add message approval or recipient limits, protect or delete ~/.wacli/config.json, avoid sensitive audio unless consent is clear, and pin dependencies with a lockfile.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and operationalizes access to environment variables, local files, and network services, but does not declare any permissions. This undermines reviewability and informed consent: users and platforms cannot accurately assess what the skill can access before installation or execution, which is especially relevant here because it handles API keys, local prompt/audio files, and outbound messaging/network calls.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented purpose describes a bounded WhatsApp automation workflow, but the skill also exposes broader standalone CLI capabilities and local credential/config handling not reflected in the description. This mismatch can hide materially different risk surfaces—such as arbitrary file-based batch processing and local secret storage—and may cause users to trust or deploy the skill under false assumptions about what it actually does.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The code persists a WhatsApp authentication token in a local JSON config file under the user's home directory, even though long-term credential storage is not clearly necessary for the described workflow. Storing reusable tokens on disk increases the chance of credential theft via local compromise, backups, shared environments, or accidental exposure.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill performs automatic processing of incoming WhatsApp content and sends automated replies, but the description does not warn users about this autonomous behavior. In a messaging context, silent automation can cause privacy, consent, and reputational issues, including processing voice notes or messages without clear notice and sending unintended responses to contacts.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code uploads user-provided audio chunks to OpenAI's Whisper API, which sends potentially sensitive voice content off-host to a third-party service. In a WhatsApp-driven automated workflow, users may not realize their messages are being remotely processed, creating a privacy and consent risk even though the upload is functionally required for transcription.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The script persists the transcript to /workspace/generated without any warning, which can leave sensitive transcribed content on disk beyond the immediate processing lifecycle. If the host is shared, backed up, or later inspected, this creates unnecessary exposure of potentially private audio-derived text.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The login flow writes the authentication token to disk immediately and silently, with no user consent, warning, or visibility into where the credential is stored. This can cause users to unknowingly leave sensitive credentials persisted on shared machines or in insecure home-directory backups.

Ssd 3

Medium
Confidence
95% confidence
Finding
The code echoes `result['revised_prompt']` back to the requester, which can include sensitive details derived from the user's original text, transcribed audio, or caption. This increases privacy exposure by reflecting potentially private content into a reply channel and may reveal transformed or expanded prompt details the user did not intend to persist or resend.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
pydub>=0.25.1
requests>=2.31.0
python-dotenv>=1.0.0
Confidence
94% confidence
Finding
openai>=1.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
pydub>=0.25.1
requests>=2.31.0
python-dotenv>=1.0.0
Confidence
94% confidence
Finding
pydub>=0.25.1

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
pydub>=0.25.1
requests>=2.31.0
python-dotenv>=1.0.0
Confidence
97% confidence
Finding
requests>=2.31.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
pydub>=0.25.1
requests>=2.31.0
python-dotenv>=1.0.0
Confidence
89% confidence
Finding
python-dotenv>=1.0.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
95% confidence
Finding
requests

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
71% confidence
Finding
python-dotenv

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.