ClawHub
Back to skill

Security audit

Diagram基础版

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Chinese-language diagram generator that uses an MCP server to create Mermaid or Draw.io files locally.

Install this only if you are comfortable configuring and running the `mcp-diagram-generator` MCP package via `npx`, and expect it to create Mermaid or Draw.io files in local `diagrams/mermaid/` or `diagrams/drawio/` directories. Non-Chinese readers should translate the instructions before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to generate and save files under local directories such as `diagrams/{format}/`, but it does not present a clear user-facing warning that invoking the skill will modify the local filesystem. In an agent environment with write and exec capabilities, silent file creation can surprise users, overwrite expected outputs, or be chained with other behaviors to persist artifacts locally.

Natural-Language Policy Violations

Medium
Confidence
85% confidence
Finding
The skill metadata and most operational instructions are written only in Chinese, which can prevent users from understanding what the skill does, what tools it uses, and that it writes files locally. This is not inherently malicious, but it increases consent and transparency risk because users who do not read Chinese may invoke behavior they did not fully understand.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.