ClawHub
Back to skill

Security audit

Markdown 重点标注

Security checks across malware telemetry and agentic risk

Overview

This is a narrow Markdown highlighting skill whose main risk is that it intentionally overwrites user-selected Markdown files.

Install only if you are comfortable with the skill modifying Markdown files you explicitly provide. Use it on copies or version-controlled files first, especially for large or important documents, because the skill does not specify backups, dry-run output, or atomic replacement.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill states that .md inputs are overwritten in place, but it does not warn users about destructive modification, backup recommendations, or safer alternatives. This creates a realistic risk of unintended data loss or corruption, especially because markdown files may contain valuable hand-edited content and the operation injects HTML into the original document.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The workflow instructs writing processed content back to the original file without any confirmation step or rollback mechanism. In the context of a content-rewriting skill, this makes accidental destruction of source material more likely and increases operational risk if the transformation is incorrect or partially applied.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal