ClawHub
Back to skill

Security audit

Math Slop

Security checks across malware telemetry and agentic risk

Overview

This skill is a local math-meme formula generator and shows no evidence of sensitive access, persistence, or hidden behavior.

Reasonable to install if you want a local generator for humorous LaTeX formulas. You should have Node.js available, and if you choose an online LaTeX renderer, remember that the formula text will be sent to that separate service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Low
Confidence
89% confidence
Finding
The manifest description says the skill should be used 'when someone asks for "math slop."' While more specific than a generic help phrase, it does not define scope, exclusions, or negative examples, so ordinary conversational mention of 'math slop' could ambiguously trigger the skill. The file does not clarify when the skill should not activate.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.