ClawHub
Back to skill

Security audit

PRD & Interactive Prototype

Security checks across malware telemetry and agentic risk

Overview

This skill creates local interactive PRD prototypes and has no evidence of hidden data access or automatic remote publishing.

Before installing, understand that generated prototypes are active HTML files with inline JavaScript, despite the package's inaccurate 'no executable script' wording. Use the default local preview for routine work, and only approve publishing when you are comfortable overwriting the target static site file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The skill claims its output is 'single-file self-contained, with no executable script' under security/compliance, but elsewhere explicitly describes a JavaScript-enabled HTML template with tabs, floating interaction panels, drawLines(), global state, and render()-driven interactivity. This mismatch can mislead reviewers or downstream automation into treating active content as inert, reducing scrutiny and increasing the chance that executable HTML/JS is opened or shared without appropriate validation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.