ClawHub
Back to skill

Security audit

Chart Gen Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a local chart-generation helper; its file-writing and command examples are mostly aligned with that purpose, with minor clarity issues but no evidence of hidden or harmful behavior.

Install only if you want a local Bash-driven chart helper. Provide explicit output paths for HTML/SVG files and avoid pointing it at important existing files, because overwrite behavior is not clearly specified. Expect possible usability issues unless the actual chart script is supplied with the skill package.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill declares activation coverage using broad scenario keywords rather than narrowly scoped trigger phrases, which can cause the agent to invoke this skill in unrelated contexts whenever generic terms like '生成', '图表', or '可视化' appear. In an MD+EXEC skill, overbroad activation increases the chance of unnecessary local command execution and unintended file generation, expanding the attack surface and creating opportunities for misuse.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The skill describes exporting and saving HTML/SVG output files but does not clearly warn users that execution may write files to disk. In a tool with write and exec capabilities, missing disclosure can lead to unintended filesystem changes, accidental overwrites, or output being written to sensitive or unexpected locations.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.