ClawHub
Back to skill

Security audit

JS SDK工具免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a JavaScript SDK helper, but its file-upload examples can send local files to an external service and even mark them public without clear warning or consent guidance.

Install only if you intend to use it for JavaScript AI SDK work. Before using its upload examples, confirm exactly which local file is being sent, avoid secrets or private project files, and do not use `public: true` unless public sharing is intended.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger conditions are broad enough to match many ordinary development and integration requests, which can cause this skill to activate in contexts beyond its intended scope. Because the skill has exec/write capability and promotes SDK/network usage, over-selection increases the chance of unnecessary command execution, external API interaction, or handling of sensitive project material without a precise user intent boundary.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill describes automatic and manual file upload flows, including an example with `public: true`, but does not give a prominent warning that local files may be transmitted to a third-party service and potentially exposed publicly. In an agent setting, this is dangerous because users may provide paths to sensitive local files or assume uploads stay private, leading to unintentional disclosure of source code, documents, or secrets.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.