ClawHub
Back to skill

Security audit

节点

Security checks across malware telemetry and agentic risk

Overview

This skill is a screen-capture helper, but its trigger wording is too broad for a privacy-sensitive action that briefly records the screen and leaves media files on disk.

Install only if you are comfortable with an agent using screen-record permission to capture the current screen or target node. Ask the agent to confirm before every capture and delete the generated snap.mp4 and snap.png files when they are no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

High
Confidence
90% confidence
Finding
The activation guidance is overly broad and effectively says to use the skill whenever the user needs vaguely 'node-related' functionality, despite the skill actually performing screen capture and file creation. In an agentic environment, such broad routing increases the chance the skill is invoked in unrelated contexts, leading to unexpected screen recording, privacy exposure, and creation of sensitive image artifacts on disk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill performs screen recording and writes artifacts such as snap.mp4 and snap.png to disk, but the description does not clearly and prominently warn users about these privacy-sensitive behaviors before use. In the context of a screen-capture skill with read/exec/write capabilities, insufficient disclosure materially increases the risk of collecting sensitive on-screen data or leaving recoverable media artifacts without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.