ClawHub
Back to skill

Security audit

Cctv News Tool Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly a CCTV news-fetching guide, but it should be reviewed because it recommends executing a remote installer directly with bash.

Review this skill before installing. Its core behavior is public news retrieval, but avoid running the `curl | bash` Bun installer as written; use a trusted package manager or verify the installer first. Also be aware that examples can create or overwrite local JSON files and cache fetched news under `./cache`.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Low
Confidence
80% confidence
Finding
The documentation instructs users to redirect output into a local file without warning that it will create or overwrite files on disk. In an agent context with exec access, undocumented file creation can surprise users, affect existing files, or leak fetched data into unintended local storage.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The caching example writes fetched data to a local cache directory without warning the user that persistent files will be created. In agent environments, silent persistence can retain potentially sensitive usage history, create clutter, or expose data to other local processes and users.

External Script Fetching

High
Category
Supply Chain
Content
| 依赖项 | 类型 | 是否必需 | 获取方式 |
|---:|---:|---:|---:|
| Node.js 16+ | 运行时 | 二选一 | 官网下载安装 |
| Bun 1.0+ | 运行时 | 二选一 | `curl -fsSL https://bun.sh/install \| bash` |
| node-html-parser | npm包 | 必需 | `npm install node-html-parser` 或 `bun add node-html-parser` |
| Python 3.8+ | 运行时 | 可选 | 辅助脚本使用 |
| LLM API | API | 必需 | 由Agent平台内置LLM提供 |
Confidence
96% confidence
Finding
curl -fsSL https://bun.sh/install \| bash

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.