ClawHub
Back to skill

Security audit

设计

Security checks across malware telemetry and agentic risk

Overview

This frontend design skill appears non-destructive, but it asks for broad command, API, and file authority without enough scoping for a simple HTML/CSS/JS generator.

Review this skill before installing if you do not want a frontend helper to run shell commands or use external APIs. If installed, use it only in a contained workspace, avoid exposing unrelated secrets, and require explicit approval for any command execution or API use.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill declares the exec tool for a frontend UI/code-generation use case without showing a narrowly scoped operational need. Unnecessary command execution expands the attack surface: if an agent routes user-controlled content into shell commands, it can lead to arbitrary command execution, file access, or environment secret exposure.

Context-Inappropriate Capability

Medium
Confidence
79% confidence
Finding
The documentation advertises external API integration for a skill whose stated purpose is generating frontend HTML/CSS/JS. Unnecessary network capability can enable silent data exfiltration of prompts, files, or generated artifacts and increases the trust boundary without clear functional justification.

Context-Inappropriate Capability

Low
Confidence
70% confidence
Finding
The skill claims broad file read/write handling beyond what is necessary for simple UI design generation. Excessive filesystem capability can expose local sensitive files or overwrite project files if the agent is induced to read or write outside the intended workspace.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The manifest frames the skill as only producing HTML/CSS/JS, while later sections advertise command execution and external API integration. This capability mismatch is dangerous because it hides the true privilege level from reviewers and users, increasing the chance the skill is granted broader permissions than its apparent purpose warrants.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.