ClawHub
Back to skill

Security audit

数据工具箱(免费版)

Security checks across malware telemetry and agentic risk

Overview

This data-analysis skill is a plain Markdown guide whose file, command, and output-writing permissions fit its stated purpose, with no hidden or deceptive behavior found.

Before using it, confirm which files, databases, APIs, and output paths the agent should touch. Prefer previews or dry runs before modifying data, and keep database credentials or API tokens in environment variables rather than scripts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Low
Confidence
75% confidence
Finding
The skill includes examples that save output files (for example via plt.savefig) without a clear, consolidated warning that executing the workflow writes to the local filesystem. In an agent environment with write and exec tools, implicit file creation can surprise users, overwrite existing artifacts, or place outputs in unintended locations if not confirmed first.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The document references executing commands and loading data into databases without a centralized safety warning covering command execution, network access, credential use, and data modification. In a skill granted exec/read/write access, this omission increases the risk that an agent performs state-changing or externally connected actions without clear user awareness and approval.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.