ClawHub
Back to skill

Security audit

HTML编码工具

Security checks for vulnerabilities and agentic risk

Overview

The skill is an HTML coding helper, but it asks for broad file and command authority while giving inconsistent guidance about execution, API use, and scope.

Review this skill before installing if your agent grants tool permissions automatically. It appears to be a documentation-only HTML helper, not malware, but its declared command and file access should be limited to the project you intend to edit and you should not provide API keys unless you know exactly which service will use them.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill is presented as a narrowly scoped HTML generator, but its metadata and body expand into API use, file handling, and command execution. This scope mismatch can mislead users and downstream agents into granting or invoking broader capabilities than expected, increasing the risk of unsafe tool use and privilege overreach.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The documentation claims the skill is not for backend/API scenarios while elsewhere advertising API integration and CI/CD-style automation. These contradictions undermine safe operator understanding and can cause the skill to be used in contexts with higher privilege or network access than users intended.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The file alternates between describing itself as pure Markdown/natural-language guidance and as execute()-enabled with command execution support. Misrepresenting execution capability is dangerous because users may trust the skill as non-executing while it is actually configured with exec access, enabling unintended command execution in agent environments.

Static analysis

No suspicious patterns detected.