ClawHub
Back to skill

Security audit

Invoice Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a local invoice PDF generator with no evidence of hidden network access, credential use, persistence, or destructive behavior.

Install only if you are comfortable running a local script that processes invoice data and writes PDFs to disk. Set INVOICE_DIR to a private folder, use deterministic installs, review or supply the missing assets/invoice.hbs template before relying on the skill, and keep Handlebars updated if security advisories apply.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Unpinned Dependencies

Low
Category
Supply Chain
Content
"version": "1.0.0",
  "private": true,
  "dependencies": {
    "handlebars": "^4.7.8"
  }
}
Confidence
93% confidence
Finding
"handlebars": "^4.7.8"

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical
Category
Supply Chain
Confidence
98% confidence
Finding
handlebars==4.7.8

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.