ClawHub
Back to skill

Security audit

Image To Perler Bead

Security checks across malware telemetry and agentic risk

Overview

This skill converts images into craft pattern files, and its file writes and Pillow dependency are disclosed and aligned with that purpose.

Install only if you are comfortable letting the agent create pattern files in a chosen output folder and, if Pillow is missing, modify a local Python virtual environment. Use a workspace output directory and review before running the dependency install command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill directs the agent to run a local Python script that writes HTML/PNG/JSON outputs, but it does not declare any permissions or boundaries for file creation. This increases the chance of unintended file writes, path misuse, or execution in sensitive directories, especially because the workflow says to build absolute paths from the user's working directory.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to create/modify a Python virtual environment and install Pillow without warning the user that the local environment will be changed. That can silently alter the host system state, pull unpinned packages from the network, and create persistence beyond the current task.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.