ClawHub
Back to skill

Security audit

Markdown导出工具(免费版)

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Markdown export helper that writes user-requested output files and does not show hidden or unrelated behavior.

Install only if you are comfortable using an external pip package for Markdown conversion. Run it on files you choose, direct outputs to a dedicated folder, check before overwriting existing files, and review any extracted code blocks before executing or sharing them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill describes commands that write output files and extract code blocks into directories or ZIP archives, but it does not warn about overwrite behavior, output path safety, or filesystem side effects. In an agent with read/exec/write tools, this can lead to accidental overwriting of user files, writing to unintended locations, or creating executable artifacts from untrusted Markdown content without sufficient user awareness.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.