ClawHub
Back to skill

Security audit

AI电商专家｜TikTok Shop 图片视频全内容

Security checks across malware telemetry and agentic risk

Overview

The skill matches its ecommerce content purpose, but needs review because its helper runs an unpinned npm package and passes the whole local environment to it.

Review this before installing. Use it only if you trust the IMIVA/@infimind npm package and the remote service with your ecommerce media and token. Prefer a pinned package version and run the helper from a shell with only the needed environment variables, especially not unrelated cloud, git, or production secrets. Confirm dry runs, estimated credits, maxCredits, and task details before creating billable content tasks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
        [npx, "-y", PACKAGE],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
Confidence
88% confidence
Finding
proc = subprocess.Popen( [npx, "-y", PACKAGE], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, bufsize=1,

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
92% confidence
Finding
os.environ.copy()

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.