ClawHub
Back to skill

Security audit

Artifact Deck

Security checks for vulnerabilities and agentic risk

Overview

Artifact Deck is a local presentation-building skill that reads user-selected notes and screenshots and writes deck-related output files, with no evidence of hidden network, credential, purchase, or persistence behavior.

Install only if you are comfortable running local Python scripts on files you choose. Use a trusted Python environment for python-pptx, provide only curated notes and screenshots, write outputs inside a known workspace folder, and review the PPTX plus manifest/build JSON before sharing because selected content and local paths may be included.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill clearly instructs the agent to read local markdown and image files and to write manifests, JSON summaries, markdown output, and a PPTX, but it does not declare corresponding permissions. This creates a policy/visibility gap: users and enforcement layers may not realize the skill can access arbitrary local paths supplied in arguments, increasing the chance of unintended data exposure or file modification.

Static analysis

No suspicious patterns detected.