ClawHub
Back to skill

Security audit

dashboard-generator

Security checks across malware telemetry and agentic risk

Overview

This skill coherently generates local HTML dashboards from user-provided JSON or CSV data, with a notable but disclosed CDN dependency for Chart.js.

Use this skill for non-sensitive or shareable datasets, or review/modify the generated HTML if you need a fully offline dashboard. Be aware that the output embeds raw data and loads Chart.js from jsDelivr when opened in a browser.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation clearly instructs users to read local input files and write generated HTML output, but it does not declare corresponding permissions. Undeclared file read/write capabilities weaken transparency and policy enforcement, increasing the chance that an agent or user invokes filesystem access without an explicit trust decision.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The generated HTML loads Chart.js from a third-party CDN, so opening the dashboard causes network access and executes remotely hosted JavaScript. This breaks the claim of a standalone dashboard and creates a supply-chain and privacy risk if the CDN is unavailable, compromised, or blocked.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The generated HTML includes a third-party CDN script without warning the user that opening the file will initiate external network requests and run remote JavaScript. In a dashboard-generation skill, this is more sensitive because users may expect a local artifact and may embed proprietary data in the file, creating privacy leakage and supply-chain exposure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.