ClawHub
Back to skill

Security audit

设计

Security checks across malware telemetry and agentic risk

Overview

This frontend design skill is mostly design and code-generation guidance, with no hidden scripts or destructive behavior found.

Before installing, treat this as a frontend design/code-generation helper. Because it declares read, write, and exec access, only use it in projects where you are comfortable with the agent editing files and running normal frontend commands, and review any command or API-key handling before execution.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill declares `exec` alongside read/write for a frontend design skill, but the document does not narrowly constrain what commands may be executed or why command execution is necessary. In an agent environment, this expands the attack surface: prompt-driven workflows could be induced to run shell commands, access local files, or chain into other tools under the guise of design assistance.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill advertises broad capabilities including file handling, API integration, command execution, and information retrieval that exceed its stated purpose of generating frontend design assets. Overbroad capability claims make it easier for an agent to invoke powerful tools in contexts unrelated to UI design, increasing the risk of data exposure, unintended system interaction, or privilege misuse.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The activation and usage description is broad enough to trigger on general design, UI, poster, and brand-visual requests without precise boundaries. In agent systems, vague routing criteria can cause unnecessary invocation of a high-privilege skill, exposing powerful tools and instructions in situations where a narrower, safer capability would have sufficed.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.