ClawHub
Back to skill

Security audit

HTML Mender

Security checks across malware telemetry and agentic risk

Overview

HTML Mender is a local HTML visual editor whose reviewed behavior matches its stated purpose, with no evidence of hidden network exfiltration or destructive actions.

Install only if you intend to edit local or saved HTML files. Do not use this on live or authenticated web pages. Treat the generated .editable.html file as a working copy because it embeds the original source for clean export; share the downloaded clean HTML result instead when possible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The documentation claims the skill is limited to local or saved HTML files, but the described behavior indicates the injected editor can operate on whatever DOM it is inserted into and auto-start by default. That scope mismatch is dangerous because it can enable editing or exporting content from arbitrary live pages, potentially including sensitive authenticated pages, violating user expectations and the stated safety boundary.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The runtime scans, edits, and exports the current live DOM via document/querySelectorAll and document.documentElement cloning, rather than enforcing that the target is a user-provided local/saved HTML file. In an injected context this can operate on arbitrary pages, causing unintended modification or exfiltration of sensitive page content when the edited HTML is downloaded.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The draft feature stores editable patches for injected pages, which expands the skill from a transient local HTML editor into a stateful page-capture tool. That broader capability increases privacy risk because modified page content can persist across sessions outside the narrow clean-export workflow promised by the skill description.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
When saving drafts, the runtime includes location.href, capturing the exact page URL alongside edit patches. For a local HTML editor this is unnecessary metadata and can expose sensitive paths, query parameters, or private application routes if used on non-local pages.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.