ClawHub
Back to skill

Security audit

book-capsule-skill

Security checks across malware telemetry and agentic risk

Overview

This skill coherently generates local book-summary HTML files, with some expected file-writing and command-execution behavior that users should understand before use.

Install only if you are comfortable with the agent writing temporary JSON and output HTML files and running the bundled Python renderer locally. Review generated content before publishing it elsewhere, and avoid feeding untrusted HTML/script-like text into the quote fields unless you intend it to appear in the generated HTML.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill directs the agent to write files and later invoke a local generator, yet it declares no permissions or user-facing consent around those capabilities. Undeclared file I/O increases the chance of surprising side effects and bypasses least-privilege expectations for a content-generation skill.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill requires `shell_executor` to run a Python command, which grants a much broader execution surface than necessary for simple HTML generation. If any path component or argument becomes attacker-controlled, this can lead to arbitrary local command execution or abuse of the host environment.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill instructs the agent to create local JSON files without clearly warning the user that local filesystem changes will occur. Hidden side effects reduce informed consent and make abuse or unexpected persistence more likely, especially in environments where users assume a read-only summarization workflow.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill asks the agent to execute a local shell command but does not provide a strong user warning or consent step for code execution. Because command execution is materially riskier than ordinary content generation, omitting notice increases the likelihood of unsafe or unexpected local actions.

Vague Triggers

Medium
Confidence
84% confidence
Finding
Several trigger phrases such as '做书摘' or '浓缩一本书' are broad enough to match ordinary reading or note-taking requests, which can cause the skill to activate when the user did not explicitly intend to use it. In this skill’s context, unintended activation could lead to unexpected local file creation or content publishing workflows, making the issue more than a purely usability concern.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.