ClawHub
Back to skill

Security audit

Skill 3d Preview

Security checks for vulnerabilities and agentic risk

Overview

This 3D preview skill is not clearly malicious, but it needs review because it writes local scene/HTML files and generates preview HTML in an unsafe, under-documented way.

Review the code before installing if you plan to open generated previews in a browser. Use only trusted scene names and scene JSON, expect local files under the skill's scenes area, and consider fixing filename validation and HTML/JavaScript escaping before relying on it.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding
The skill metadata/documentation declares no permissions, yet the analyzed behavior indicates file-write capability. That mismatch prevents users and the platform from making an informed trust decision and can enable unexpected local persistence such as scene JSON or HTML files being written to disk. In this context, a 3D preview/export skill may legitimately need file output, but it is still dangerous when not explicitly declared.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The declared purpose is simple 3D preview/export, but the detected behavior includes local file persistence, modification of scene files, generation of HTML, and loading external Three.js resources from a CDN. This expands the trust boundary beyond what the skill promises and can expose users to unanticipated filesystem changes, dependency risk from remote content, and deceptive functionality since the exposed interface does not actually provide the stated preview behavior. The mismatch makes the skill materially more dangerous because users may invoke it expecting harmless rendering while it performs broader side effects.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The Three.js exporter interpolates untrusted scene fields directly into an HTML/JavaScript template without escaping. A crafted scene name or object data can break out of the intended string/markup context and inject script into the generated preview page, leading to arbitrary JavaScript execution when the file is opened.

Static analysis

No suspicious patterns detected.