ClawHub
Back to skill

Security audit

拼豆图纸生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local bead-pattern generator that reads a user-provided image or JSON file and writes pattern output files as expected.

Install only if you are comfortable with the agent running the bundled local Python script on images or JSON files you provide and writing SVG/HTML/CSV/JSON outputs to paths you or the defaults select. Review output paths when using --out, --html, --csv, or --json-out.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs running a local Python script that reads user-supplied image/JSON files and writes multiple outputs (SVG, HTML, CSV, JSON), but it does not declare any permissions for file access. That creates a capability/permission mismatch: users or platforms may not realize the skill can access local files and persist generated artifacts, which weakens least-privilege controls and auditability.

Static analysis

No suspicious patterns detected.