ClawHub
Back to skill

Security audit

Interactive Doc Mapper

Security checks across malware telemetry and agentic risk

Overview

This skill locally turns workflow data into an interactive HTML diagram and shows no hidden network, credential, purchase, or destructive behavior.

Install only if you are comfortable with a skill that can inspect repo structure and write generated JSON/HTML documentation files. Review generated diagrams before sharing them because they may expose internal architecture details, private URLs, or sensitive workflow notes if those are included in the input.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill instructs the agent to inspect the repository, validate JSON, and generate HTML files, which implies file read/write capabilities, but no permissions are declared in the skill metadata. This mismatch can lead to silent over-privilege, weak user awareness, and unsafe execution in systems that rely on declared permissions for policy enforcement or review.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.