ClawHub
Back to skill

Security audit

酷家乐AI室内设计

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Kujiale interior-design workflow that uses a local token, image upload, script execution, and account quota in ways that fit its stated purpose.

Use this only when you intend to connect a Kujiale account for interior design. Review any local Node scripts before running them, keep the .kjlconfig.json token private, upload only floor-plan images you want sent to Kujiale, and confirm quota-consuming layout actions before proceeding.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
80% confidence
Finding
The activation trigger is overly broad: any request mentioning interior design or renovation design may invoke a skill that performs command execution, file monitoring, network calls, and potentially billable operations. In an agent environment, underspecified routing increases the chance of unintentional invocation, causing privacy-impacting local access or unintended external actions without sufficiently explicit user intent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill advertises local command execution, reading credential material, and monitoring a local inbound media directory, but does not present a prominent upfront warning or consent step before these behaviors. In agent contexts, that is dangerous because users may think they are invoking a simple design assistant while the skill is authorized to inspect local paths, consume secrets, and perform external uploads on their behalf.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.