ClawHub
Back to skill

Security audit

axiv-html-cn-static

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it downloads arXiv paper assets and builds a local Chinese HTML page, with some disclosed network and dependency caveats.

Use this with arXiv IDs you intend to process, choose an output folder you control, and adapt the example paths before running. For stricter offline or supply-chain requirements, install dependencies in an isolated environment and replace the default MathJax CDN reference with a local renderer.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill clearly instructs the agent to install dependencies, fetch remote arXiv content, and write output files, but it does not declare permissions or explicitly surface those capabilities as part of the skill contract. This creates a mismatch between what the skill appears authorized to do and what it actually directs the agent to do, increasing the risk of unexpected network and filesystem side effects.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The generated page is described as a local/static HTML artifact, but it loads MathJax from a remote CDN at runtime. This creates a supply-chain and privacy risk: viewing the page triggers external network access and allows a compromised or changed CDN resource to influence script execution in the local page.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The instructions direct the agent to download remote content and generate local outputs, but they do not explicitly warn the user that executing the skill will access the network and modify the filesystem. In an agent setting, that lack of disclosure can undermine informed consent and lead to surprising side effects, especially when processing untrusted URLs or writing into user directories.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.