ClawHub

AI Coding Toolkit

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only AI coding guide, with disclosed advice about prompts, reviews, and project rule files but no hidden execution behavior.

Safe to install as a guide. Review any generated .cursorrules, CLAUDE.md, AGENTS.md, or prompt-library files before committing them, because those files can shape future agent behavior in your project.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The quick-start instruction uses a very broad natural-language trigger, "Set up AI coding for my project," which can overlap with ordinary user requests and unintentionally activate the skill in unrelated contexts. In an agent ecosystem, broad activation phrases increase the chance of accidental invocation, causing the agent to apply this skill when the user did not explicitly intend it, which can misdirect workflows or override more appropriate task-specific skills.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The skill exposes broad natural-language commands such as 'Set up AI coding for [project]' and 'Review this AI output' without defining required inputs, boundaries, or safety checks. In an agent setting, such open-ended triggers can cause the skill to activate on vague user text and perform over-broad guidance or unsafe automation in sensitive repositories.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal