ClawHub
Back to skill

Security audit

Photo Webcam Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a simple webcam snapshot guide whose file and network behavior fits its stated purpose, though users should choose output paths and callback use carefully.

Install only if you are comfortable with an agent downloading public webcam images, reading or editing a favorites JSON file, and writing snapshot files to paths you specify. Prefer temporary output paths such as /tmp, avoid pointing it at sensitive files, and do not provide a callback_url unless you trust the destination and understand what result data may be sent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill advertises local image saving and includes exec/write capabilities, but it does not clearly warn users that running it can create or overwrite files on the local filesystem. In an agent context, this can lead to unintended file modifications, especially if output paths are influenced by user input or defaults are unclear.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documented `callback_url` parameter allows sending results or metadata to a remote endpoint, but the skill does not warn users about outbound transmission. In an agent setting, this can cause unintentional exfiltration of execution results, environment details, or usage metadata to attacker-controlled infrastructure.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.