ClawHub
Back to skill

Security audit

Chuwi Minibook

Security checks for vulnerabilities and agentic risk

Overview

The skill’s description says it monitors system hardware, but its code instead searches local knowledge and insight-history files, so users should review it before installing.

Install only if you are comfortable with a skill that appears mislabeled: it claims to be a Chuwi/system monitor, but the current code searches local knowledge and insight history. There is no evidence of exfiltration or persistence, but the publisher should align the documentation with the code, narrow triggers, and disclose local data access.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes broad terms like "system info" and especially "chuwi," which can appear in normal conversation and may cause accidental invocation outside the user's intent. Because this skill gathers local system status information, unintended activation could expose device details such as battery, hardware, or resource usage when the user did not explicitly request monitoring.

Static analysis

No suspicious patterns detected.