ClawHub
Back to skill

Security audit

Python工具包-免费版

Security checks across malware telemetry and agentic risk

Overview

This is mostly a Python best-practices reference skill, but it asks for command execution and file-writing authority that its own documentation does not justify.

Review before installing. The content itself looks like ordinary Python guidance, but the skill should not need shell execution or write access for that purpose. Prefer installing only if the publisher narrows the trigger conditions and removes or clearly justifies exec/write permissions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill is presented as a knowledge-only Python best-practices assistant, but its manifest and capability descriptions imply operational behaviors such as create/query/export and tool-backed execution. This mismatch can cause the agent to grant or invoke capabilities beyond what users reasonably expect, increasing the risk of unintended file or command actions.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
Including `exec` for a best-practices guidance skill violates least privilege because command execution is not required to explain Python pitfalls or provide examples. If invoked by the agent on user-controlled input, this could enable shell command execution, local data access, or environmental manipulation far outside the advertised scope.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The documentation states the skill is a pure Markdown, no-API knowledge tool, yet the manifest declares `exec` and `write`. This contradiction is dangerous because reviewers and users may trust the lower-risk description while the runtime still has higher-risk capabilities that could modify files or execute commands.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger condition is broad enough to match generic development, debugging, and deployment requests, which can cause the skill to activate outside its intended niche. Overbroad activation increases the chance that its unnecessary privileged tools are brought into routine workflows, expanding exposure and making misuse more likely.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.