ClawHub
Back to skill

Security audit

Python数据可视化-免费版

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Python chart-generation guide with expected local file outputs and package setup, with no evidence of hidden or malicious behavior.

Install only if you want an agent to generate and run Python visualization code locally. Expect it to read your selected data files, install common plotting packages if needed, and create chart files such as PNG, SVG, PDF, or HTML in the working directory; specify safe output names and ask before overwriting existing files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger condition is broad enough to activate on many generic requests about analysis, reporting, or visualization, increasing the chance the agent invokes this skill unnecessarily. In an MD+EXEC skill with read/write/exec tools, over-broad routing raises the risk of unintended code generation and execution in contexts where the user did not explicitly consent to filesystem changes or command execution.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises export and write-capable behavior without an upfront warning that using it may create or overwrite local files. In a tool set that includes write and exec, lack of explicit disclosure can lead to unexpected filesystem modification, accidental data loss, or stealthy artifact creation when the user expected analysis only.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The examples directly save PNG/SVG/PDF outputs without any notice about local file creation, which normalizes write operations as side effects. In an agent-executed context, this can cause unintended filesystem changes and makes it easier for malicious prompts to hide writes inside seemingly harmless visualization tasks.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Exporting an HTML file is a filesystem write and may also produce content that users later open in a browser, so omitting a warning increases operational risk. While the shown example is not itself malicious, silent HTML artifact creation in an exec-capable skill is more sensitive than transient in-memory plotting.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.