ClawHub
Back to skill

Security audit

exam-rescue-html

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local exam-review HTML generator, with normal cautions about automatic file writes, overwrites, local note access, and CDN-loaded math rendering.

Install only in the intended exam workspace. Review the generated HTML before relying on it, avoid editing the generated output in place if you may regenerate it, and be aware that opening the HTML may contact unpkg.com to load KaTeX for math rendering.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The template pulls KaTeX CSS and JavaScript from unpkg.com at render time, which introduces an unnecessary external dependency for a skill whose stated purpose is local HTML generation. This creates supply-chain and privacy risks: remote content could change, fail, or be tampered with, and opening the generated HTML may trigger unexpected outbound network requests.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases include broad terms like '继续' and '重新生成', which can cause the skill to activate in contexts the user did not intend, especially in multi-step workflows. Because activation leads to file reads, retrieval calls, and file creation/overwrite, accidental invocation can have side effects without clear user awareness.

Missing User Warnings

High
Confidence
93% confidence
Finding
The skill is designed for silent file-writing and explicitly emphasizes zero-wait, automatic completion without surfacing operational details to the user. Silent creation of JSON and HTML artifacts in the workspace reduces informed consent and can be abused to create or overwrite files unexpectedly, especially if the workspace is shared or the user is unaware of side effects.

Missing User Warnings

High
Confidence
96% confidence
Finding
The '静默执行协议' suppresses confirmation, hides intermediate activity, and instructs silent fallback on errors. This combination is dangerous because it conceals file operations, retrieval activity, and failure modes from the user, making unintended writes or partial/corrupt outputs harder to detect and easier to normalize.

Missing User Warnings

Medium
Confidence
78% confidence
Finding
The workflow calls a knowledge-base retrieval interface on selected points without any privacy or data-access disclosure. If the note retrieval layer can access sensitive study materials, proprietary notes, or broader workspace content, the skill may pull in data the user did not expect to be processed and embed it into generated artifacts.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The '重新生成' behavior explicitly overwrites old files without warning or confirmation. This creates a risk of losing prior output, replacing user-modified files, or repeatedly changing artifacts through accidental retriggers, especially given the broad trigger model and silent execution design.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.