ClawHub
Back to skill

Security audit

多平台摄影配文

Security checks across malware telemetry and agentic risk

Overview

This caption-writing skill mostly contains normal writing guidance, but it asks for shell and file-write authority plus an under-explained callback URL that do not fit the stated purpose.

Review this skill before installing and avoid granting exec, write, API-key, or callback access unless you can sandbox and constrain it. The caption guidance itself is not destructive, but the requested authorities are broader than needed for generating social media captions, so do not use it with sensitive photos, private metadata, or credentials unless those paths are clarified.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill is presented as a caption-generation tool, but later advertises unrelated file handling, API integration, command execution, and information retrieval capabilities. This scope inflation can cause an agent or user to grant unnecessary authority and creates confusion about what operations the skill may legitimately perform, increasing the attack surface beyond the stated purpose.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
Declaring exec capability for a text-generation skill violates least-privilege expectations and enables shell access that the task does not require. In an agent environment, this can be abused to run arbitrary commands, inspect local files, exfiltrate data, or pivot into other system resources if the skill is invoked inappropriately.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The documentation inconsistently labels the skill as both MD+EXEC and pure Markdown-only. This ambiguity is dangerous because operators may underestimate the permissions actually available, while runtime systems may expose stronger capabilities than reviewers expect, undermining trust and safe deployment decisions.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
Exposing a callback_url parameter without a clear warning or restriction creates a data egress risk. Photo descriptions, metadata, and generated captions may be transmitted to arbitrary external endpoints, enabling unintended disclosure of sensitive contextual information or abuse via attacker-controlled URLs.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.