ClawHub
Back to skill

Security audit

story-import

Security checks across malware telemetry and agentic risk

Overview

This skill builds a reusable writing project from a user-provided manuscript, with broad but disclosed local file changes that fit its purpose.

Install only if you want an agent to read your manuscript and create or update a local writing-project directory. Review the target paths before confirming import, especially when an existing project has tracking files, because the skill may archive old tracking state and set .active-book for the imported title.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly instructs the agent to read user-supplied files, write large project structures, and execute shell/Python commands, yet it declares no permissions. That creates a dangerous transparency gap: a host or reviewer may treat it as low-risk while it can still perform filesystem changes and command execution on arbitrary project data.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The declared description frames the skill as an import/parser, but the body also performs state initialization, tracking-database maintenance, consistency checks, atomic writes, and lifecycle management of project metadata. This mismatch can mislead users and enforcement layers into authorizing a broader set of destructive operations than they expected, increasing the chance of unsafe invocation on real repositories.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger list includes very broad everyday phrases such as '导入' that can be used in many benign conversations unrelated to this skill. Because the skill performs file reads, writes, project activation, and command execution, accidental invocation could cause unintended processing or repository modifications without the user meaning to launch a destructive import workflow.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/tracking_commit.py:37