ClawHub
Back to skill

Security audit

本地文件整理虾

Security checks across malware telemetry and agentic risk

Overview

This is a local file organizer that can move files and write local reports, so it needs careful use but does not show hidden, deceptive, or malicious behavior.

Install only if you want an agent to help reorganize local folders. Use it on a specific folder, review `--dry-run` output first, keep backups for important files, prefer trash over permanent deletion, and avoid sharing generated report files if filenames or paths are sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill clearly performs local file write operations by moving, copying, renaming, and potentially generating reports, yet no permissions are declared. Undeclared write capability weakens user consent and platform enforcement because a caller may not realize the skill can modify filesystem state before invocation.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented behavior does not fully match the actual behavior: it apparently creates local JSON reports containing file paths and operation history, while duplicate handling and bulk renaming are more limited than advertised. Behavior mismatches are dangerous because users may grant trust or consent under incorrect assumptions, leading to unexpected data exposure in reports or unintended file modifications.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document describes duplicate-file deletion and retention heuristics that can permanently remove files, but it does not clearly warn that heuristics such as keeping the newest, shortest-path, or most 'standard' filename can select the wrong file. In a local file organizer skill, users are likely to act on this guidance directly, so insufficient safety guidance increases the risk of unintended data loss.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.