ClawHub
Back to skill

Security audit

Publish Ascii Excalidraw

Security checks across malware telemetry and agentic risk

Overview

This skill is a diagram-conversion helper that writes disclosed Excalidraw files locally and shows no evidence of hidden collection, credential use, or destructive behavior.

Install if you are comfortable with generated diagrams and intermediate JSON files being saved under ~/.excalidraw/. Avoid feeding highly sensitive architecture diagrams unless you are prepared to manage or delete those saved local files afterward.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a mismatch because the description centers on ASCII-art-to-Excalidraw conversion and incremental generation from analyzed diagram structure, but the provided code does not parse ASCII art, analyze diagram structure, or generate modules from text. Instead, it only combines already-created Excalidraw element arrays into a final file and fixes cross-element references. That behavior is related to Excalidraw processing, but it is materially different from the declared primary purpose.

Session Persistence

Medium
Category
Rogue Agent
Content
**Default output: `~/.excalidraw/`**. All `.excalidraw` files and intermediate module JSONs MUST be saved here. Never use `/tmp/` or the user's home directory root for output.

Before starting, create the directories:

```bash
mkdir -p ~/.excalidraw/modules
Confidence
60% confidence
Finding
create the directories: ```bash mkdir -p ~/.excalidraw

Session Persistence

Medium
Category
Rogue Agent
Content
**Between modules**, maintain consistent coordinate space. Track cursor positions so subsequent modules align properly.

Write each module to a JSON file under `~/.excalidraw/modules/`:
```
~/.excalidraw/modules/module_1.json
~/.excalidraw/modules/module_2.json
Confidence
60% confidence
Finding
Write each module to a JSON file under `~/.excalidraw/modules/`: ``` ~/.excalidraw/modules/module_1.json ~/.excalidraw/modules/module_2.json ... ``` **IMPORTANT**: All `.excalidraw` output files must

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.