ClawHub
Back to skill

Security audit

Diagram生成器

Security checks for vulnerabilities and agentic risk

Overview

The diagram skill has a clear purpose, but it asks users to run an unpinned external connector via npx and permits broad file creation or overwriting.

Install only if you are comfortable adding a protocol server that can execute an external npm package and write files in your workspace. Verify the connector package source and version before use, and restrict output paths to a dedicated diagrams directory.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent/user to configure and launch an external npx-based protocol service, which expands the trust boundary from static diagram generation to arbitrary package retrieval and local command execution. Even if intended for legitimate connector setup, using npx -y can fetch and run remote code at install/runtime, creating supply-chain and execution risk beyond the advertised skill purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill repeatedly describes creating directories, writing files, and overwriting outputs, but it lacks a prominent upfront warning or consent boundary for filesystem side effects. In an agent context with write and exec tools enabled, this increases the chance of unexpected local modifications, clobbering existing files, or writing to attacker-influenced paths if user-supplied filenames/paths are not carefully constrained.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.