ClawHub
Back to skill

Security audit

酷家乐设计-免费版

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for a real interior-design API workflow, but it asks users to run unbundled local scripts and handle access tokens in ways that need review before installation.

Review before installing. Only use this skill in a clean project where you know exactly what ./scripts/*.js files will run, prefer an environment variable or managed secret over .kjlconfig.json, add any local config file to .gitignore, restrict file permissions, and avoid passing long-lived tokens in command-line arguments when possible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The skill gives conflicting secret-handling guidance: earlier setup instructions direct users to store an access token in a local JSON file, while the security section recommends environment variables. This inconsistency increases the likelihood that long-lived credentials are written to disk, accidentally committed, read by other tools, or exposed through agent file access.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The setup instructions tell users to place an access token in a local JSON file without a strong, immediate warning about credential exposure. In a skill that has read/exec/write tool context and is likely used in project directories, plaintext tokens in config files are at realistic risk of accidental disclosure through source control, logs, filesystem access, or prompt-assisted file reads.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.