ClawHub
Back to skill

Security audit

ui-ux-toolkit

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed UI/UX design-system helper, but users should review its workspace writes and setup commands before use.

Before installing, confirm you actually want a skill that can run local Python commands and write design-system files into the project. Use --persist only in a repository where design-system/ can be created or updated, review diffs after use, and do not let an agent run sudo or administrator package-install commands automatically.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly supports persistent writes into the project directory via `--persist` and describes a fixed `design-system/` layout, but it does not clearly warn that running the tool will create or overwrite repository files. In an agent context with `write` and `exec` enabled, silent workspace mutation can alter tracked content, clobber existing artifacts, or poison downstream prompts and code generation that consume those files.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
brew install python3
# ...
# Ubuntu/Debian
sudo apt update && sudo apt install python3 python3-pip
# ...
# Windows
winget install Python.Python.3.12
Confidence
95% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
brew install python3
# ...
# Ubuntu/Debian
sudo apt update && sudo apt install python3 python3-pip
# ...
# Windows
winget install Python.Python.3.12
Confidence
95% confidence
Finding
sudo

Chaining Abuse

High
Category
Tool Misuse
Content
brew install python3
# ...
# Ubuntu/Debian
sudo apt update && sudo apt install python3 python3-pip
# ...
# Windows
winget install Python.Python.3.12
Confidence
90% confidence
Finding
&& sudo

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.