ClawHub
Back to skill

Security audit

思维导图生成（免费版）

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple mind-map generation guide with broad but disclosed local read/write/command capabilities and no evidence of hidden or destructive behavior.

Install only if you are comfortable letting the agent read your provided documents, create mind-map output files, and optionally run local commands for dependencies or rendering. Do not provide a callback_url unless you trust that destination and are comfortable with generated results being sent there.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill declares both `exec` and `write` capabilities but does not clearly warn users that it may run shell commands or modify local files. In an agent environment, these permissions materially expand the attack surface because normal-looking user prompts could trigger command execution or filesystem changes without informed consent.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documented `callback_url` parameter enables outbound network transmission of task results, but the skill provides no warning about privacy, data disclosure, or SSRF-style risks. If agent output or document content is sent to arbitrary URLs, sensitive local or user-provided data could be exfiltrated to attacker-controlled endpoints.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.