ClawHub
Back to skill

Security audit

HTML 转桌面应用

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Electron packaging helper, but users should confirm the target project and packaged files before building.

Install only if you want Codex to modify a local web project into an Electron desktop app. Before running it, confirm the target folder is correct and review packaged contents, especially secrets, remote API dependencies, signing credentials, and files copied into release artifacts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The default prompt uses a broad invocation phrase to package 'this local web project' without any explicit activation constraints, scope checks, or trust boundaries. In an agent setting, underspecified triggers can cause the skill to be invoked in contexts the user did not clearly intend, potentially leading to risky packaging of unreviewed local content or unnecessary build/signing-related actions.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.