ClawHub
Back to skill

Security audit

Whatsapp Styling Guide Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a WhatsApp formatting guide, but it declares unnecessary shell execution access that its own documentation says it does not need.

Install only if you are comfortable with the skill manifest requesting broader tools than the guide appears to need. A safer version would remove exec, and likely avoid write unless the skill is expected to modify local files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The manifest grants the `exec` tool even though the documentation explicitly claims the skill is pure Markdown and does not require command execution. This mismatch unnecessarily expands the agent's attack surface: a caller or downstream agent may trust the documentation and enable the skill in a higher-privilege context, while the manifest still permits shell execution if invoked.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.