ClawHub

Continuous Learner

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed continuous-learning automation wrapper, but it can trigger broad workflow and skill-generation behavior through external local code that is not packaged for review.

Review this before installing if you do not explicitly want an automation skill that can run local learning pipelines, update a knowledge base, and generate skills. Only use it in an environment where you understand the external db/continuous_learner.py implementation it will import, and avoid daemon mode unless you have a clear stop procedure and resource limits.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrase "pipeline" is extremely generic and is likely to match ordinary user requests unrelated to this skill, causing accidental invocation. In this skill, accidental activation is more dangerous than usual because the advertised actions include running a full multi-stage automation flow and starting a continuous daemon, which could lead to unintended background activity or downstream actions.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation exposes a daemon mode that starts continuous background operation but does not clearly warn users about persistence, repeated execution, or ongoing resource consumption. In the context of a skill described as a "fully automatic closed loop" that collects, ingests, generates, and reports continuously, lack of warning materially increases the risk of unintended autonomous behavior and surprise side effects.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal