ClawHub
Back to skill

Security audit

glmv-prd-to-app

Security checks across malware telemetry and agentic risk

Overview

This app-building skill is broadly purpose-aligned, but it can install tooling and reset local data without enough scoping or warning.

Install only for disposable development workspaces. Review any generated start.sh before running it, keep private unrelated files out of the workspace, avoid production or shared databases, and preinstall or pin Playwright/Chromium if dependency control matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
except ImportError:
        print("Installing playwright...")
        import subprocess
        subprocess.run([sys.executable, "-m", "pip", "install", "playwright"], check=True)
        subprocess.run([sys.executable, "-m", "playwright", "install", "chromium"], check=True)
        return True
Confidence
94% confidence
Finding
subprocess.run([sys.executable, "-m", "pip", "install", "playwright"], check=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print("Installing playwright...")
        import subprocess
        subprocess.run([sys.executable, "-m", "pip", "install", "playwright"], check=True)
        subprocess.run([sys.executable, "-m", "playwright", "install", "chromium"], check=True)
        return True

def render_url(url: str, output_path: str, width: int = 1280, height: int = 800,
Confidence
94% confidence
Finding
subprocess.run([sys.executable, "-m", "playwright", "install", "chromium"], check=True)

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The overall pattern is a genuine security concern: the screenshot utility self-installs both Python packages and browser binaries at runtime. That behavior is especially problematic in a production-ready app-generation skill, where execution may occur in CI, developer workstations, or agent-managed environments and can lead to uncontrolled environment changes, supply-chain exposure, and policy violations.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger guidance is so broad that generic requests like '帮我开发' or 'build this' can invoke a highly privileged skill whenever PRD-like materials are present in the workspace. That increases the chance of accidental activation of a skill that reads files, runs shell commands, resets state, and starts services without the user clearly consenting to those specific actions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The seed-loading instructions explicitly direct clearing existing data to support idempotent re-seeding, but there is no required warning, backup step, or confirmation gate. In a reused workspace or connected development environment, this can destroy valuable data or erase prior work unexpectedly.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The deployment script requirements include cleaning previous state and setting up the database from scratch, which implies destructive resets during startup without an explicit data-loss warning. Packaging this into a single startup command makes accidental execution more likely and can wipe persistent state in one step.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script can print full API response bodies in verbose mode and also emits a structured JSON summary containing request metadata and any captured bodies. When used against production-like environments, this can expose sensitive data such as user records, tokens, internal error details, or PII into terminal logs, CI artifacts, or shared debugging output. In this skill context, which is meant to generate and validate production-ready apps, the risk is higher because developers may run it against real deployed APIs during testing or deployment verification.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.