ClawHub

Skill Validator 4f8f6e

Security checks across malware telemetry and agentic risk

Overview

This is a simple Markdown guide about creating skills, with no executable code or hidden install behavior, though its trigger phrases are broader than ideal.

Before installing, be aware that the skill may activate on generic words like "skill" or "how to use." It appears safe from a security standpoint, but narrower triggers would make it less intrusive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger field contains broad, generic phrases such as "如何使用" and "skill", which can match many unrelated user requests and cause unintended invocation. Over-broad activation increases the chance that the skill hijacks conversations outside its intended scope, leading to confusing behavior or unsafe tool chaining in larger agent systems.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The invocation scenarios are vague, for example triggering when the user says "skill-validator" or merely needs related help, without clear boundaries on what qualifies as relevant. This makes accidental activation more likely and can route unrelated user requests into this skill unexpectedly.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal