ClawHub
Back to skill

Security audit

analyze-digital-construction-technologies-rd

Security checks across malware telemetry and agentic risk

Overview

This skill is a scoped research-and-reporting workflow that uses disclosed evidence sources and a local Word-report generator without hidden or destructive behavior.

Before installing, confirm you are comfortable with a workflow that may use authorized web/PatSnap research services and produces local report files. Use reviewed JSON inputs, avoid placing confidential evidence in outputs unless intended, and verify patent/legal or engineering conclusions with qualified specialists as the skill itself advises.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a mismatch because the description presents the skill as an analysis capability for digital construction technology intelligence, competitive landscapes, patent landscapes, market-entry research, R&D planning, and technical due diligence. The actual code does not collect, search, analyze, or infer anything from patents, scientific literature, commercial sources, or projects. Instead, it is a document-generation utility that takes already-reviewed JSON content, validates required fields and evidence references, and renders a Word report. While report generation is related to the topic domain, the primary purpose materially differs from the claimed analytical function.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The manifest describes a skill for analyzing digital and intelligent construction technologies using evidence sources, which implies research and assessment behavior. This file implements report-generation output behavior, including writing a schema JSON and a Word report to local files, which is a material operational behavior not reflected in the manifest description.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The code creates output directories and saves a DOCX file to disk after processing reviewed JSON input. While related to presenting analysis results, persistent document generation is a distinct capability from the manifest's stated analytical purpose and should be declared if intended.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The instruction says to "Produce an English report" as a fixed requirement. This is a natural-language locale policy issue because it forces a specific language for all users without documenting opt-in, alternatives, or a justified region-specific constraint.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
### Step 6 — Generate deliverables

Prepare a concise executive summary plus methods, evidence tables, limitations and appendices. Generate Word only from a reviewed JSON evidence package using `scripts/generate_word_report.py`. A web/HTML report may be produced only when requested; the source package contains no HTML generator, so do not add one to this package without approval.

### Step 7 — Review
Confidence
75% confidence
Finding
without approval

Self-Modification

High
Category
Rogue Agent
Content
def write_schema(path: Path, force: bool) -> None:
    if path.exists() and not force:
        raise ValueError(f"Refusing to replace existing file without --force: {path}")
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(json.dumps(SCHEMA_EXAMPLE, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
Confidence
85% confidence
Finding
replace existing file

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.