ClawHub
Back to skill

Security audit

auto-lamp-ip-advisor

Security checks across malware telemetry and agentic risk

Overview

This skill creates automotive lamp IP analysis reports and its file creation and PatSnap patent lookup behavior are disclosed and aligned with that purpose.

Before installing, users should be comfortable with the skill creating local report files and using a configured PatSnap MCP account to search patents and fetch patent images. Treat its IP conclusions as preliminary because the artifact itself says formal FTO review should be done by a patent professional.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill requires generating an HTML report and then packaging it into a ZIP, which causes local file creation as part of normal execution. Because the instructions do not clearly warn the user or require explicit consent before writing files, the agent could modify the local filesystem unexpectedly, which is a security and trust issue even if the files are not inherently malicious.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
This section contains concrete Python code that writes an HTML file and creates a ZIP archive on disk, but it does not pair those actions with a clear permission check or warning about filesystem modification. In an agent environment, implicit file writes can be abused or can surprise users, especially if run automatically or repeatedly, leading to unwanted artifacts, data exposure through predictable filenames, or disk clutter.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.